CVE-2023-47213 Hardcoded credentials in CFR-1004EA, CFR-1008EA, CFR-1016EA
Remote attackers can use hard-coded passwords to access and modify DVR configuration data on affected First Corporation devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47213?
CVE-2023-47213 is a critical vulnerability in First Co., Ltd. CFR-1004EA, CFR-1008EA, CFR-1016EA, published on 16 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
Weakness: CWE-798
Which versions are affected by CVE-2023-47213?
It affects 28 products.
Products include C-First Cfr-1004ea Firmware, C-First Cfr-1008ea Firmware, C-First Cfr-1016ea Firmware, C-First Cfr-16eaa Firmware, C-First Cfr-16eab Firmware, C-First Cfr-16eha Firmware and 22 more.
How do I fix CVE-2023-47213?
No fix has been published for CVE-2023-47213 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-47213 being exploited?
There is no known exploitation of CVE-2023-47213 in the wild and no public exploit code.
Other vulnerabilities in First Co., Ltd. CFR-1004EA, CFR-1008EA, CFR-1016EA
Sources
Also known as GHSA-hchc-m7jw-6mhm.