CVE-2023-44860
Published: 06 October 2023
Summary
CVE-2023-44860 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Netis-Systems N3M Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 6.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-44860 affects NETIS SYSTEMS N3Mv2 version 1.0.1.865 and stems from an improper authorization flaw (CWE-863) in the HTTP request authorization component. The vulnerability carries a CVSS 3.1 score of 7.5 with a vector indicating network attack vector, low complexity, no required privileges or user interaction, and high impact on availability while leaving confidentiality and integrity untouched.
A remote attacker can send crafted HTTP requests that bypass or misuse the authorization logic, resulting in denial of service against the affected device. The attack requires no credentials and can be launched over the network, directly matching the published description of remote unauthenticated DoS via the authorization component.
The two reference URLs both point to the same GitHub repository containing a technical write-up of the improper authentication mechanism but contain no vendor advisory, patch information, or mitigation guidance. The associated EPSS score has remained flat at 0.1046 with no material rise observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-49183
Vulnerability details
An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTTP request.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Periodic review and update of procedures reduces incorrect authorization implementations over time.
Supervision identifies cases where authorization logic incorrectly permits unauthorized actions.
Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
The authorization process and usage restrictions help prevent incorrect authorization for remote access types.
Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
Ensures authorization decisions for external system use are correctly implemented and enforced.