CVEvulnerability
CVE-2023-36483
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-03-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-639
Description
Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and
MASmobile Classic iOS version 1.7.24 and earlier
which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.
Affected configurations
• honeywell masmobile asp.net services (<= 1.9)
• honeywell masmobile classic (<= 1.7.24)
• honeywell masmobile classic (<= 1.16.18)
Related
Weakness · CWE (1)
- CWE-639 Authorization Bypass Through User-Controlled Key weakness
References
- https://www.corporate.carrier.com/product-security/advisories-resources/ Not Applicable, Vendor Advisory
- https://www.corporate.carrier.com/product-security/advisories-resources/ Not Applicable, Vendor Advisory