CVE-2023-0452 is a weak-hashing flaw (CWE-327/CWE-328) in Econolite EOS, roadway traffic signal controller software: versions before 3.2.23 store privileged user credentials, including those of administrators and technicians, as unsalted MD5 hashes inside a configuration file that an unauthenticated network attacker can read, letting the hashes be cracked or reused against the controller. NVD's own Primary CVSS v3.1 score is 5.3 (medium), while the CISA ICS-CERT source that filed the advisory separately rates the same flaw 9.8 (critical).
Vulnerability summary
5.3
Medium
0.5%
EPSS score (FIRST)
No
CISA KEV catalog
2023-01-26
Published
Vulnerability ID: CVE-2023-0452 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Econolite EOS roadway traffic signal controller software | cpe:2.3:a:econolite:eos:*:*:*:*:*:*:*:* | Econolite EOS prior to 3.2.23, per CISA ICSA-23-026-02 |
What does this mean for affected devices?
CVE-2023-0452 (CWE-327, use of a broken/risky cryptographic algorithm, cross-referenced by NVD to CWE-328, reversible one-way hash) affects Econolite EOS, which Econolite markets as its "EOS Traffic Signal Controller Software for Smarter Traffic Flow" (Econolite — EOS Traffic Signal Controller Software), the control software that runs inside roadway intersection traffic signal cabinets.
NVD's description states: "Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials. A configuration file that is accessible without authentication uses MD5 hashes for encrypting credentials, including those of administrators and technicians" (NVD).
NVD records a Primary CVSS v3.1 score of 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N — network-reachable disclosure of the hash file only, with no integrity or availability impact assessed at the file-read step. The CISA ICS-CERT enrichment source that originated the advisory instead records a Secondary score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, treating the eventual credential compromise and the control actions it enables as full confidentiality, integrity and availability loss (NVD).
The flaw is tracked in CISA's ICS advisory ICSA-23-026-02, which NVD lists as a Third Party Advisory / US Government Resource reference for this CVE, alongside the related hardcoded-access CVE-2023-0451 affecting the same EOS release line (CISA ICSA-23-026-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0055 (46.4th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Agencies and operators running Econolite EOS controllers before 3.2.23 should upgrade per CISA's advisory, restrict network access to the controller's configuration interface, and rotate any administrator or technician credentials that may already have been exposed.
Evidence
- Econolite EOS versions prior to 3.2.23 use a weak hash algorithm for encrypting privileged user credentials; a configuration file accessible without authentication uses MD5 hashes for credentials, including those of administrators and technicians. — NVD
- NVD Primary CVSS v3.1 score 5.3 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; CISA ICS-CERT recorded a separate Secondary score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
- CVE-2023-0452 is documented in CISA ICS advisory ICSA-23-026-02, cited by NVD as a Third Party Advisory / US Government Resource reference. — CISA ICSA-23-026-02
- Econolite markets EOS as traffic signal controller software, i.e. the control software that runs roadway intersection signal cabinets. — Econolite — EOS Traffic Signal Controller Software
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0055 (46.4th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
Why does CVE-2023-0452 have two very different severity scores, 5.3 and 9.8?
NVD's own Primary score (5.3) rates only the immediate step — an unauthenticated attacker reading the hash file — as a confidentiality-only impact, while the CISA ICS-CERT Secondary score (9.8) rates the full downstream consequence of cracking and reusing those credentials against the traffic signal controller as complete confidentiality, integrity and availability loss (per NVD).
What exactly is exposed in the vulnerable configuration file?
The file stores MD5-hashed usernames and passwords for every defined user on the Econolite EOS controller, including administrators and technicians, and is readable by a remote attacker without any authentication (per NVD).
Which Econolite EOS versions are affected and what is the fix?
Versions prior to 3.2.23 are affected; CISA's advisory ICSA-23-026-02 covers the remediation for this and the related hard-coded-access flaw CVE-2023-0451 in the same release line (per CISA ICSA-23-026-02).
What should an agency running Econolite EOS do in response?
Upgrade to 3.2.23 or later per CISA's advisory, restrict network access to the controller's configuration interface, and rotate administrator and technician credentials that may already have been exposed, since the weak MD5 hashes could already have been harvested and cracked (per CISA ICSA-23-026-02).