VULNERABILITY INTELLIGENCE

CVE-2023-28345

CVSS score4.6 MEDIUM

EPSS probability0.32%

CISA KEVNot currently listed

Published2023-05-31

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to the affected endpoint and obtain the teacher's password. This enables them to log into the Teacher Console and begin trivially attacking student machines.

Weakness classification

nvd@nist.gov: CWE-312
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-312

Primary references

cve@mitre.org — Exploit, Mitigation, Release Notes, Third Party Advisory
cve@mitre.org — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Release Notes, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory