CVE-2023-43631
Exposed Creds in Linuxfoundation Edge Virtualization Engine ≤ 8.6.0
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-43631 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Linuxfoundation Edge Virtualization Engine. Its CVSS base score is 8.8 (High).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-48031
Vulnerability Data
On boot, the Pillar eve container checks for the existence and content of “/config/authorized_keys”. If the file is present, and contains a supported public key, the container will go on to open port 22 and enable sshd with the given…
more
keys as the authorized keys for root login. An attacker could easily add their own keys and gain full control over the system without triggering the “measured boot” mechanism implemented by EVE OS, and without marking the device as “UUD” (“Unknown Update Detected”). This is because the “/config” partition is not protected by “measured boot”, it is mutable, and it is not encrypted in any way. An attacker can gain full control over the device without changing the PCR values, thus not triggering the “measured boot” mechanism, and having full access to the vault. Note: This issue was partially fixed in these commits (after disclosure to Zededa), where the config partition measurement was added to PCR13: • aa3501d6c57206ced222c33aea15a9169d629141 • 5fef4d92e75838cc78010edaed5247dfbdae1889. This issue was made viable in version 9.0.0 when the calculation was moved to PCR14 but it was not included in the measured boot.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring confidentiality/integrity protection for stored credentials directly mitigates insufficiently protected credentials on disk or in configuration stores.
Training instructs users on protecting credentials from disclosure or unauthorized access.
Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.
Tracking information locations and access supports secure storage practices instead of insecure ones.
Establishing an alternate site with equivalent protections directly mitigates insecure storage of sensitive backup information.
Requiring protection of backup information directly addresses insecure storage of sensitive data in backups.
Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.
Rules of behavior include credential protection and non-sharing requirements, reducing exposure of insufficiently protected credentials.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing other controls (e.g. access restrictions, marking, disposal); it performs none of the verb on CWE-522's insecure credential transmission/storage, which requires technical protections like encryption or secure channels that this governance clause does not supply.
A.5.17 mandates secure allocation, transmission, storage, hashing/encryption per 8.24, strong non-reusable passwords, immediate change of defaults/compromise, and no cleartext — directly stopping exploitation of insufficiently protected credentials with only a bounded remainder (e.g. non-password authenticators or post-storage exposure vectors outside its scope).
A.6.2 sets contractual terms, NDAs, and communicates responsibilities to personnel; it has no technical effect on how credentials are protected in transmission or storage and cannot stop exploitation of CWE-522
Regular reminders about password security and personal accountability make users less likely to store or transmit credentials in cleartext or other unprotected forms.
A.8.24's purpose, guidance (b,c), and key management mandate proper cryptography (algorithms, strength, protection of credentials in storage/transmission) per classification, which stops exploitation of insufficiently-protected credentials; remainder is bounded (e.g. non-cryptographic protections like hashing-only or non-crypto obfuscation per CWE-522 details).
A.8.5 mandates MFA, alternative strong methods, no cleartext transmission/storage of passwords, session termination, brute-force protection and secure log-on procedures that directly stop interception/retrieval of credentials even when they exist, leaving only a bounded remainder (e.g. non-password credentials or post-authentication storage outside log-on flows)
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.