What is the CVSS score of CVE-2023-27573?

CVE-2023-27573 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2023-27573?

NetBox Docker deployments running versions before 2.5.0 contain hardcoded superuser credentials that grant complete administrative control to any attacker with network access.

How to fix or mitigate CVE-2023-27573?

Within 24 hours: Audit all NetBox Docker instances to identify affected versions and change the default admin password and SUPERUSER_API_TOKEN immediately. Within 7 days: Upgrade to NetBox-docker 2.5.0 or later across all environments, rotate all API tokens and credentials that may have been exposed, and review audit logs for unauthorized access. Within 30 days: Implement network access controls restricting NetBox access to authorized users only, enable multi-factor authentication for administrative accounts, and conduct a full security review of any modifications made to network inventory data.

Docker CVE-2023-27573

CRITICAL

Use of Default Credentials (CWE-1392)

2026-03-11 cve@mitre.org

Docker Information Disclosure

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 06:17 nvd

CRITICAL 9.0

DescriptionCVE.org

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.