CVE-2023-20101 Hardcoded credentials in Cisco Emergency Responder

Critical 9.8 Published 4 Oct 2023 Updated 16 Dec 2025

Unauthenticated attackers can log in as root using static default credentials to execute arbitrary commands on Cisco Emergency Responder systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-20101?

CVE-2023-20101 is a critical vulnerability in Cisco Emergency Responder, published on 4 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, which has default, static credentials that cannot be changed or deleted. This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an affected system. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user.

Weakness: CWE-798

Which versions are affected by CVE-2023-20101?

It affects 1 product.

Products include Cisco Emergency Responder.

How do I fix CVE-2023-20101?

No fix has been published for CVE-2023-20101 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-20101 being exploited?

There is no known exploitation of CVE-2023-20101 in the wild and no public exploit code.

Sources

Also known as GHSA-58fq-3f6f-rpf2.