Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-51838 is a high-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Meshcentral Meshcentral. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0724
Vulnerability Data
Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-13 requires selection and implementation of specific cryptography types, directly stopping use of broken algorithms.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.31 only requires identifying, reviewing and considering legal/regulatory/contractual requirements (including crypto restrictions); it does not itself stop use of a broken algorithm or block its exploitation
A.5.6 only promotes membership in groups to receive early warnings, advisories, and specialist advice about vulnerabilities (including risky crypto); it does not stop exploitation of an already-present broken algorithm, which requires other controls (e.g. A.8.24) to act.
A.8.24's policy, algorithm selection, strength/quality rules, approved standards and key management directly stop use of broken/risky algorithms in most cases; the bounded remainder is non-compliant implementations or legacy systems grandfathered under the clause's own regulatory and transition guidance.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.