What is CVE-2023-36483?

CVE-2023-36483 is a medium-severity vulnerability in Honeywell Masmobile Asp.net Services, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2024-03-16.

How severe is CVE-2023-36483?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2023-36483 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Honeywell Masmobile Asp.net Services

CVE-2023-36483

Authorization bypass can be achieved by session ID prediction in MASmobile Classic Android version 1.16.18 and earlier and MASmobile Classic iOS version 1.7.24 and earlier which allows remote attackers to retrieve sensitive data including customer data, security system status, and event history.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.005 (39.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Honeywell Masmobile_asp.net_services
Honeywell Masmobile_classic
Mas (A Carrier Brand) Asp.net Services — versions 1
Mas (A Carrier Brand) Masmobile Classic — versions 1

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

Public proof-of-concept exploits

References

productsecurity@carrier.com (Not Applicable, Vendor Advisory)

Frequently asked questions

What is CVE-2023-36483?: CVE-2023-36483 is a medium-severity vulnerability in Honeywell Masmobile Asp.net Services, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2024-03-16.
How severe is CVE-2023-36483?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2023-36483 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.