CVE-2023-45194
Medium
Description
Use of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 (-D/-K/-S/-DK/-DKS/-M/-W) firmware Ver. 1.03.45 and earlier allows a network-adjacent unauthenticated attacker to intercept wireless LAN communication, when the affected product performs the communication without changing the pre-shared key from the factory-default configuration.
SeverityMedium
CVSS4.3
Exploit probability—
ProductMrl Mr-gm2 Firmware
PublishedOct 11, 2023
First seenOct 11, 2023
How to fix
Update
- mrl mr-gm2_firmware3.01.00 or later
- mrl mr-gm3-d_firmware1.04.00 or later
- mrl mr-gm3-k_firmware1.04.00 or later
- mrl mr-gm3-s_firmware1.04.00 or later
- mrl mr-gm3-dks_firmware1.04.00 or later
- mrl mr-gm3-m_firmware1.04.00 or later
- mrl mr-gm3-w_firmware1.04.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mrl mr-gm2_firmware | v < 3.01.00 | 3.01.00 |
| mrl mr-gm3-d_firmware | v < 1.04.00 | 1.04.00 |
| mrl mr-gm3-k_firmware | v < 1.04.00 | 1.04.00 |
| mrl mr-gm3-s_firmware | v < 1.04.00 | 1.04.00 |
| mrl mr-gm3-dks_firmware | v < 1.04.00 | 1.04.00 |
| mrl mr-gm3-m_firmware | v < 1.04.00 | 1.04.00 |
| mrl mr-gm3-w_firmware | v < 1.04.00 | 1.04.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.