Skip to main content

H8951 4G Esp Firmware CVE-2023-49253

CRITICAL
Use of Hard-coded Credentials (CWE-798)
2024-01-12 cvd@cert.pl
Authentication Bypass H8951 4G Esp Firmware
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 19:34 vuln.today
CVE Published
Jan 12, 2024 - 15:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Root user password is hardcoded into the device and cannot be changed in the user interface.

AnalysisAI

Root user password is hardcoded into the device and cannot be changed in the user interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. Root user password is hardcoded into the device and cannot be changed in the user interface. Affected products include: Hongdian H8951-4G-Esp Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

More in H8951 4G Esp Firmware

View all
CVE-2023-49255 CRITICAL
9.8 Jan 12

The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order
CVE-2023-49262 CRITICAL
9.8 Jan 12

The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided the
CVE-2023-49254 HIGH
8.8 Jan 12

Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destinati
CVE-2023-49257 HIGH
8.8 Jan 12

An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execut
CVE-2023-49261 HIGH
7.5 Jan 12

The "tokenKey" value used in user authorization is visible in the HTML source of the login page. Rated high severity (CV
CVE-2023-49256 HIGH
7.5 Jan 12

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded
CVE-2023-49259 HIGH
7.5 Jan 12

The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and
CVE-2023-49258 MEDIUM
6.1 Jan 12

User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS v
CVE-2023-49260 MEDIUM
6.1 Jan 12

An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path. Rate

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-49253 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy