CVE-2023-49255 Router console accessible without authentication
An unauthenticated attacker can execute commands as a logged-in admin on Hongdian routers, potentially creating new admin accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-49255?
CVE-2023-49255 is a critical authentication bypass vulnerability in Hongdian H8951-4G-ESP, published on 12 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.
Weakness: CWE-306
Which versions are affected by CVE-2023-49255?
It affects 1 product.
Products include Hongdian H8951-4g-Esp Firmware.
How do I fix CVE-2023-49255?
No fix has been published for CVE-2023-49255 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-49255 being exploited?
There is no known exploitation of CVE-2023-49255 in the wild and no public exploit code.
Other vulnerabilities in Hongdian H8951-4G-ESP
- CVE-2023-49253 Predefined root password
- CVE-2023-49262 Buffer overflow vulnerability in Cookie authentication field
- CVE-2023-49254 Command injection in the network test tools
- CVE-2023-49257 Command execution using the certificate upload utility
- CVE-2023-49256 Predictable encryption passphrase used in publicly accessible configuration file
Sources
Also known as GHSA-fw6m-hgqv-hr8c.