CVE-2023-0451 is a high-severity improper-access-control flaw (CWE-284) in Econolite's EOS traffic signal control software, which municipalities use to operate intersection signal cabinets: versions before 3.2.23 let an unauthenticated remote attacker read log, database and configuration files without a password, including one file holding MD5-hashed usernames and passwords for every defined user of the control software, and NVD has published its own Primary CVSS v3.1 score of 7.5 (high) for the flaw.
Vulnerability summary
7.5
High
0.8%
EPSS score (FIRST)
No
CISA KEV catalog
2023-01-26
Published
Vulnerability ID: CVE-2023-0451 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Econolite EOS traffic signal control software | — | Versions prior to 3.2.23, per NVD and CISA; fixed in 3.2.23 and later |
What does this mean for affected devices?
CVE-2023-0451 (CWE-284, improper access control) affects Econolite's EOS, traffic signal control software deployed in roadside cabinets to operate intersection signals. NVD's description states: "Econolite EOS versions prior to 3.2.23 lack a password requirement for gaining 'READONLY' access to log files and certain database and configuration files. One such file contains tables with MD5 hashes and usernames for all defined users in the control software, including administrators and technicians" (NVD).
NVD lists the CVE's status as "Modified" with its own Primary CVSS v3.1 base score of 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — matching the Secondary score CISA's ICS-CERT separately submitted (NVD).
CISA's advisory ICSA-23-026-02 bundles this flaw with a companion vulnerability, CVE-2023-0452 (CVSS v3.1 9.8, critical) — EOS uses a weak, unsalted MD5 hash to encrypt those same privileged user credentials, so an attacker who first reads the exposed file via CVE-2023-0451 can realistically crack the administrator and technician password hashes it contains. CISA credits the find to researcher Rustam Amin and states the combined risk plainly: "Successful exploitation of these vulnerabilities could result in a remote unauthenticated attacker gaining full control over traffic lights" (CISA ICS Advisory ICSA-23-026-02).
CISA places EOS in the Transportation Systems sector, deployed in the United States and Canada, and recommends updating to EOS version 3.2.23 or later via Econolite's support channel, alongside the standard ICS guidance to minimize network exposure for all control-system devices and ensure they are not accessible from the internet (CISA ICS Advisory ICSA-23-026-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00848 (58.3th percentile) as of 2026-11-07 — a high-severity traffic-controller credential-exposure flaw with a confirmed NVD score and an available vendor fix, but no reported in-the-wild exploitation (CISA KEV, FIRST EPSS).
Any EOS deployment still running a version prior to 3.2.23 should be updated and should not be reachable from the public internet, since the exposed credential file combined with the weak-hash companion flaw gives an unauthenticated attacker a realistic path to administrator access over live traffic signals.
Evidence
- Econolite EOS versions prior to 3.2.23 lack a password requirement for READONLY access to log files and certain database/configuration files; one such file contains MD5 hashes and usernames for all defined users, including administrators and technicians. — NVD
- NVD status 'Modified'; NVD Primary CVSS v3.1 base score 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, matching CISA's Secondary submission. — NVD
- Advisory ICSA-23-026-02 bundles CVE-2023-0451 with CVE-2023-0452 (weak MD5 hash algorithm, CVSS v3.1 9.8); reported by Rustam Amin; 'Successful exploitation of these vulnerabilities could result in a remote unauthenticated attacker gaining full control over traffic lights.' Sector: Transportation Systems, deployed in United States and Canada. Fix: update to EOS 3.2.23 or later. — CISA ICS Advisory ICSA-23-026-02
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00848 (58.3th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What can an attacker actually do if they exploit CVE-2023-0451?
An unauthenticated remote attacker can read log, database and configuration files on an affected Econolite EOS traffic signal controller without a password — including a file holding MD5-hashed usernames and passwords for every defined user, up to administrators and technicians (per NVD).
Does NVD have its own confirmed severity score for this CVE, or is it only a vendor estimate?
NVD lists its own Primary CVSS v3.1 base score of 7.5 (high) for CVE-2023-0451, matching the Secondary score CISA's ICS-CERT separately submitted, both using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (per NVD).
Is CVE-2023-0451 more dangerous when combined with other EOS vulnerabilities?
Yes — CISA's advisory ICSA-23-026-02 bundles it with CVE-2023-0452, in which EOS encrypts those same privileged credentials with a weak, unsalted MD5 hash. Reading the exposed file via CVE-2023-0451 gives an attacker crackable administrator and technician password hashes, and CISA warns the combined risk is a remote unauthenticated attacker 'gaining full control over traffic lights' (per CISA ICS Advisory ICSA-23-026-02).