What is the CVSS score of CVE-2023-47674?

CVE-2023-47674 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Cfr 1004Ea Firmware CVE-2023-47674

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2023-11-16 vultures@jpcert.or.jp

Authentication Bypass Cfr 1004Ea Firmware Cfr 1008Ea Firmware Cfr 1016Ea Firmware Cfr 16Eaa Firmware Cfr 16Eab Firmware Cfr 16Eha Firmware Cfr 16Ehd Firmware Cfr 4Eaa Firmware Cfr 4Eaam Firmware Cfr 4Eab Firmware Cfr 4Eabc Firmware Cfr 4Eha Firmware Cfr 4Ehd Firmware Cfr 8Eaa Firmware Cfr 8Eab Firmware Cfr 8Eha Firmware Cfr 8Ehd Firmware Cfr 904E Firmware Cfr 908E Firmware Cfr 916E Firmware Md 404Aa Firmware Md 404Ab Firmware Md 404Ha Firmware Md 404Hd Firmware Md 808Aa Firmware Md 808Ab Firmware Md 808Ha Firmware Md 808Hd Firmware

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 16, 2023 - 08:15 nvd

CRITICAL 9.8

DescriptionNVD

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

AnalysisAI

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround. Affected products include: C-First Cfr-1004Ea Firmware, C-First Cfr-1008Ea Firmware, C-First Cfr-1016Ea Firmware, C-First Cfr-16Eaa Firmware, C-First Cfr-16Eab Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.