What is the CVSS score of CVE-2023-27573?

CVE-2023-27573 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2023-27573?

NetBox Docker deployments running versions before 2.5.0 contain hardcoded superuser credentials that grant complete administrative control to any attacker with network access.

How to fix or mitigate CVE-2023-27573?

Within 24 hours: Audit all NetBox Docker instances to identify affected versions and change the default admin password and SUPERUSER_API_TOKEN immediately. Within 7 days: Upgrade to NetBox-docker 2.5.0 or later across all environments, rotate all API tokens and credentials that may have been exposed, and review audit logs for unauthorized access. Within 30 days: Implement network access controls restricting NetBox access to authorized users only, enable multi-factor authentication for administrative accounts, and conduct a full security review of any modifications made to network inventory data.

Docker CVE-2023-27573

CRITICAL

Use of Default Credentials (CWE-1392)

2026-03-11 cve@mitre.org

Information Disclosure Docker Netbox Docker

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 06:17 nvd

CRITICAL 9.0

DescriptionCVE.org

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.