CVE-2023-43870

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-19 · updated 2026-06-17
Weakness: CWE-798

Description

When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create their own certificates to emulate another site. Then by establishing a proxy service to emulate the site they could monitor traffic passed between the end user and the site allowing access to the data content.

Affected products

Paxton Net2: from 6.02 before 6.07; 6.07 — fixed in 6.07

How to fix

Upgrade to a fixed version: Paxton Net2 6.07. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-43870 or the next vulnerability affects your stack