CVE-2023-47674 Missing authorization in CFR-1004EA, CFR-1008EA, CFR-1016EA
Remote unauthenticated attackers can rewrite or obtain configuration information on First Corporation DVRs due to missing authentication for critical functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47674?
CVE-2023-47674 is a critical missing authorization vulnerability in First Co., Ltd. CFR-1004EA, CFR-1008EA, CFR-1016EA, published on 16 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
Weakness: CWE-306
Which versions are affected by CVE-2023-47674?
It affects 28 products.
Products include C-First Cfr-1004ea Firmware, C-First Cfr-1008ea Firmware, C-First Cfr-1016ea Firmware, C-First Cfr-16eaa Firmware, C-First Cfr-16eab Firmware, C-First Cfr-16eha Firmware and 22 more.
How do I fix CVE-2023-47674?
No fix has been published for CVE-2023-47674 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-47674 being exploited?
There is no known exploitation of CVE-2023-47674 in the wild and no public exploit code.
Other vulnerabilities in First Co., Ltd. CFR-1004EA, CFR-1008EA, CFR-1016EA
Sources
Also known as GHSA-h9h6-5vxm-9xx3.