PT-2023-20642 · Usr · Usr-G806

Nikki2023 · Published 2023-05-11 · Updated 2024-05-17 · CVE-2023-2645

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions USR USR-G806 version 1.0.41

Description A critical issue was found in the Web Management Page component, where the manipulation of the username/password argument with the input root leads to the use of a hard-coded password. This can be exploited remotely. The issue has been publicly disclosed and may be used for attacks. It is recommended to change the configuration settings.

Recommendations To resolve the issue, change the configuration settings for USR USR-G806 version 1.0.41. As a temporary workaround, consider restricting access to the Web Management Page until the issue is fully addressed. Avoid using the default root input for the username/password argument to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2023-2645

Affected Products

Usr-G806

References · 7

• 🔥 https://github.com/wswokao/testrouter/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2645 · Security Note
• https://osv.dev/vulnerability/CVE-2023-2645 · Vendor Advisory
• https://vuldb.com/?id.228774 · Note
• https://t.me/cvenotify/50837 · Telegram Post
• https://vuldb.com/?ctiid.228774 · Note
• https://t.me/cibsecurity/63867 · Telegram Post