CVE-2023-39808 Hardcoded credentials in n/a

Critical 9.8 Published 21 Aug 2023 Updated 9 Jul 2026

Attackers can gain root access via SSH using a hardcoded password in NVK iBSG devices, requiring vendor patching or credential rotation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-39808?

CVE-2023-39808 is a critical vulnerability in n/a, published on 21 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH service. The cleartext password corresponding to the $1$4Tmm01jl$7HRvcW.bz7uGmX9hiQWvR hash was not determined by the vulnerability discoverer.

Weakness: CWE-798

Which versions are affected by CVE-2023-39808?

It affects 1 product.

Products include Nvki Intelligent Broadband Subscriber Gateway.

How do I fix CVE-2023-39808?

No fix has been published for CVE-2023-39808 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-39808 being exploited?

There is no known exploitation of CVE-2023-39808 in the wild and no public exploit code.

Sources

Also known as GHSA-62fj-4xw4-4wqj.