CVE-2023-53983 Anevia Flamingo XL/XS 3.6.20 Default Credentials Authentication Bypass
Attackers can use hard-coded default credentials to gain full remote control of Anevia Flamingo encoders, requiring immediate credential changes or firmware updates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-53983?
CVE-2023-53983 is a critical vulnerability in Ateme Anevia Flamingo XL/XS, published on 30 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.
Weakness: CWE-798
Which versions are affected by CVE-2023-53983?
It affects 4 products.
Products include Ateme Flamingo Xl Firmware, Ateme Flamingo Xs Firmware, Ateme Soaplive, Ateme Soapsystem.
How do I fix CVE-2023-53983?
No fix has been published for CVE-2023-53983 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-53983 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-53983 exists.
Other vulnerabilities in Ateme Anevia Flamingo XL/XS
Sources
Also known as GHSA-rg8q-q5qg-28fm.