Is CVE-2023-46133 actively exploited?

No active exploitation of CVE-2023-46133 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-46133 be exploited remotely?

Yes. CVE-2023-46133 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-46133?

CVE-2023-46133 has a CVSS score of 9.1 (CRITICAL).

HOME VULNERABILITIESCVE-2023-46133

CRITICAL

CVE-2023-46133

CWE-328Published: October 25, 2023· Updated: Jun 17, 2026

9.1

CVSS v3.1

Official Description

CryptoES is a cryptography algorithms library compatible with ES6 and TypeScript. Prior to version 2.1.0, CryptoES PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 2.1.0 contains a patch for this issue. As a workaround, configure CryptoES to use SHA256 with at least 250,000 iterations.

NVD Source

Technical Analysis

CVE-2023-46133 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 9.1.