CVE-2023-46380 describes a critical vulnerability in various LOYTEC LINX, LVIS, and LIOB devices where password-change requests are transmitted over cleartext HTTP, exposing credentials. This allows an unauthenticated attacker to intercept sensitive information with low attack complexity, leading to a high confidentiality impact. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness of its potential risk.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.2.4CPE matchmatch criteria | cpe:2.3:o:loytec:linx-212_firmware:6.2.4:*:*:*:*:*:*:* | ||
6.2.2CPE matchmatch criteria | cpe:2.3:o:loytec:lvis-3me12-a1_firmware:6.2.2:*:*:*:*:*:*:* | ||
6.2.3CPE matchmatch criteria | cpe:2.3:o:loytec:liob-586_firmware:6.2.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.