Vulnerability · Published Feb 17, 2023 · Assigned by TR-CERT
CVE-2023-0882Authorization Bypass Through User-Controlled Key on Single Connect
High 8.8
In plain English
A high-severity authorization bypass via user-controlled key in Single Connect from Kron Tech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.7%top 46.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Kron Tech Single Connect on Windows allows Privilege Abuse. This issue affects Single Connect: 2.16.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kron Tech | Single Connect | 2.16 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://docs.krontech.com/singleconnect-2-16/update-patch-rdp-proxy-idor-vulnerability
- https://www.usom.gov.tr/bildirim/tr-23-0092 government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0092 government-resource