What’s Vulnerable › Vulnerabilities

CVE-2023-24080

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-21 · updated 2026-07-09
• Weakness: CWE-307

Description

A lack of rate limiting on the password reset endpoint of Chamberlain myQ v5.222.0.32277 (on iOS) allows attackers to compromise user accounts via a bruteforce attack.

Affected products

• Chamberlain Myq: 5.222.0.32277

References

• http://web.archive.org/web/20230122144550/https://brackish.io/chamberlain-myq-account-takeover/
• https://archive.ph/NH0Bk
• http://web.archive.org/web/20230122144550/https://brackish.io/chamberlain-myq-account-takeover/
• https://archive.ph/NH0Bk

Get alerted when CVE-2023-24080 or the next vulnerability affects your stack