CVEvulnerability
CVE-2023-26462
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2023-02-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-798
Description
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usable for privilege escalation) are stored in an insecure format. (To read this stored data, the attacker needs access to the application server or its source code.)
Affected configurations
• thingsboard thingsboard 3.4.1
Related
Weakness · CWE (1)
- CWE-798 Use of Hard-coded Credentials weakness
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/238544 Third Party Advisory, VDB Entry
- https://thingsboard.io/docs/reference/releases/ Release Notes
- https://exchange.xforce.ibmcloud.com/vulnerabilities/238544 Third Party Advisory, VDB Entry
- https://thingsboard.io/docs/reference/releases/ Release Notes