CVE-2023-5456 is a high severity (CVSS 8.1) hard-coded credentials flaw in the MariaDB database used by the web application in the AiLux imx6 bundle. Versions below imx6_1.0.7-2 are affected. Nozomi Networks says to update to imx6_1.0.7-2, which closes the issue.
What's affected
- Product: AiLux imx6 bundle.
- Affected: versions below imx6_1.0.7-2.
- Fixed: imx6_1.0.7-2, per the Nozomi Networks advisory.
- Severity: 8.1 High in both the NVD record and the Nozomi advisory (vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Reporter credited by Nozomi: Andrea Palanca of Nozomi Networks.
How to check if you're exposed
Find the bundle version on the device or in the vendor management tool, and compare it with imx6_1.0.7-2. The advisory does not describe a command for reading the version, so use the AiLux documentation or your supplier for the exact method.
Also check network exposure. The record describes a remote unauthenticated attacker reaching the database service, so confirm whether the database port is reachable from any network other than the device itself. A quick port check from a management host tells you what the device exposes:
nmap -Pn -p 3306 <device-address>
An open database port on an unpatched device raises the urgency.
What to do now
- Update the imx6 bundle to imx6_1.0.7-2 or later, following the AiLux or supplier instructions.
- Until the update lands, restrict network access to the device so only a management network can reach it.
- Block database ports at the network edge and between internal segments.
- Treat any data stored on the device as possibly read, and decide whether credentials stored there should be rotated.
- Record the bundle in your asset inventory with its version, so future advisories map to it.
Why it matters
The record describes use of a hard-coded credential for the MariaDB database that backs the device's web application. Anyone who learns the credential, for example by reading it out of one device or a firmware image, can use it against every device that ships with the same value. That is the core problem with CWE-798: the secret is shared, fixed, and not under the owner's control.
The attacker gets the same privileges as the web application, so the impact covers the data the application holds and the configuration it manages. Nozomi describes the consequence as an unauthenticated attacker being able to manipulate the device configuration. The attack complexity is rated high in the vector, which tempers the score a little. The CVE is not in the CISA Known Exploited Vulnerabilities catalog according to the record.
Quick check
Can I fix this by changing the database password?
The advisory solution is to update the bundle. If the credential is built into the product, changing it yourself may not be possible or supported. Follow the vendor update path.
Sources
Last reviewed: 19 October 2026.
