PatchTheCVECVE-2023-33372: Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware use
CVE-2023-33372 is a critical-severity flaw (CVSS 9.8) affecting connected io. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker and send messages on behalf of devices, impersonating them. in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 45%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2023-08-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-33372?
connected io: upgrade to newer than 2.1.0. Exact commands for each OS are on this page.
Is CVE-2023-33372 being exploited?
CVE-2023-33372 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-33372 affect?
CVE-2023-33372 affects connected io. Severity is critical (CVSS 9.8). Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication using MQTT. An attacker who gained access to these credentials is able to connect to the MQTT broker an
How urgent is CVE-2023-33372?
Priority 53/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-33378 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communi
- CVE-2023-33377 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of
- CVE-2023-33376 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its c
- CVE-2023-33375 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, e
- CVE-2023-33374 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management plat