CVE-2023-6259: Local Access to Sensitive Data in Brivo ACS100 and ACS300

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-19 · updated 2026-06-17
Weakness: CWE-284

Description

Insufficiently Protected Credentials, : Improper Access Control vulnerability in Brivo ACS100, ACS300 allows Password Recovery Exploitation, Bypassing Physical Security.This issue affects ACS100, ACS300: from 5.2.4 before 6.2.4.3.

Affected products

Brivo Acs100 Firmware: from 5.2.4 before 6.2.4.3 — fixed in 6.2.4.3
Brivo Acs300 Firmware: from 5.2.4 before 6.2.4.3 — fixed in 6.2.4.3

How to fix

Upgrade to a fixed version: Brivo Acs100 Firmware 6.2.4.3; Brivo Acs300 Firmware 6.2.4.3. Check the vendor advisory for mitigations.

References

https://sra.io/advisories/
https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#brivo_firmware_release_6_2_4_3
https://sra.io/advisories/
https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#brivo_firmware_release_6_2_4_3

Get alerted when CVE-2023-6259 or the next vulnerability affects your stack