CVE-2023-6259
Exposed Creds in Brivo Acs100 Firmware 5.2.4 – 6.2.4.3
Raw vector
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2023-6259 is a high-severity Improper Access Control (CWE-284) vulnerability in Brivo Acs100 Firmware. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58504
Vulnerability Data
Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical Security.This issue affects ACS100, ACS300: from 5.2.4 before 6.2.4.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability provides local access to sensitive data including insufficiently protected credentials, enabling adversaries to collect and steal credentials from files via improper access control and password recovery exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 9 hardening rules · 5 OS baselines
V10.3.5V11.3.3
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Training covers access control policies and the consequences of improper access grants or usage by users.
Documenting role-based training completion allows verification that only trained individuals receive or retain access, making improper access control harder to exploit through untrained personnel.
Documented and acknowledged rules define permitted access, reducing improper access control by establishing clear behavioral boundaries and accountability.
Disabling all system access and revoking credentials upon termination directly prevents improper access control by former personnel.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Device lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Explicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encrypting data-at-rest fully prevents insecure credential storage while only partially satisfying the broader data-protection outcome.
Encrypting data-in-transit fully prevents interception of credentials in motion while only partially satisfying the broader data-protection outcome.
Credential management practices directly reduce insecure storage/transmission but do not guarantee encryption or transport protection.
Protecting identity assertions covers conveyance of credentials but is narrower than full credential lifecycle protection.
PR.AA-05 directly enforces policy-based access management and least privilege, eliminating most improper-access-control defects, yet CWE-284 also covers implementation flaws and design gaps outside a single management control.
Hardened baselines and deviation monitoring directly eliminate most configuration-induced access-control defects, yet CWE-284 also encompasses code-level and design flaws outside the scope of configuration management alone.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Defining and enforcing explicit access rights and restrictions for each entity directly stops the assignment of permissions that exceed what is required, eliminating the root condition that allows improper access control.
Formal authorization, role-based provisioning, and timely revocation of access rights directly stop the creation of accounts or permissions that exceed what the business actually needs.
By enforcing explicit rules on which identities or groups may perform read, write, delete or execute operations and by denying anonymous access to sensitive data, the control directly stops the creation of overly permissive or missing access-control checks.
Requiring one-to-one mapping of identities to entities and timely removal of unused identities directly stops attackers from leveraging stale or shared accounts to bypass access restrictions.
Requiring protected storage, transmission, and non-display of passwords prevents credentials from being stored or sent in clear text where they can be harvested by unauthorized actors.
By explicitly transferring security roles and responsibilities when personnel change jobs or leave, the control reduces the chance that former employees retain access rights they no longer need, thereby limiting improper access control.