CVE-2023-33759

The system does not implement mechanisms limiting the number of failed authentication attempts (CWE-307 — Improper Restriction of Excessive Authentication Attempts). An attacker can send an unlimited number of login requests over the network, systematically testing combinations of authentication credentials. The lack of account lockout, time limits, or CAPTCHA mechanisms makes brute force attacks feasible without any technical obstacles.

A successful attack allows the attacker to gain unauthorized access to the PBX system, which may lead to complete takeover of the telephone exchange, violation of data confidentiality and integrity, and potential disruption of communication services.

Patches available from the manufacturer should be applied according to the references. Additionally, it is recommended to implement compensating controls, such as restricting access to the login interface at the firewall level, introducing login attempt limits, and monitoring anomalous authentication patterns.

SpliceCom Maximiser Soft PBX version 1.5 and earlier.