What is the CVSS score of CVE-2023-47213?

CVE-2023-47213 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Cfr 1004Ea Firmware CVE-2023-47213

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2023-11-16 vultures@jpcert.or.jp

Authentication Bypass Cfr 1004Ea Firmware Cfr 1008Ea Firmware Cfr 1016Ea Firmware Cfr 16Eaa Firmware Cfr 16Eab Firmware Cfr 16Eha Firmware Cfr 16Ehd Firmware Cfr 4Eaa Firmware Cfr 4Eaam Firmware Cfr 4Eab Firmware Cfr 4Eabc Firmware Cfr 4Eha Firmware Cfr 4Ehd Firmware Cfr 8Eaa Firmware Cfr 8Eab Firmware Cfr 8Eha Firmware Cfr 8Ehd Firmware Cfr 904E Firmware Cfr 908E Firmware Cfr 916E Firmware Md 404Aa Firmware Md 404Ab Firmware Md 404Ha Firmware Md 404Hd Firmware Md 808Aa Firmware Md 808Ab Firmware Md 808Ha Firmware Md 808Hd Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 16, 2023 - 08:15 nvd

CRITICAL 9.8

DescriptionNVD

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

AnalysisAI

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround. Affected products include: C-First Cfr-1004Ea Firmware, C-First Cfr-1008Ea Firmware, C-First Cfr-1016Ea Firmware, C-First Cfr-16Eaa Firmware, C-First Cfr-16Eab Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.