PT-2023-26095 · Unknown · I-Doit Open+1

Published 2023-09-09 · Updated 2023-09-19 · CVE-2023-37755

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions i-doit pro versions 25 and below I-doit open versions 25 and below

Description The software is configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).

Recommendations For i-doit pro versions 25 and below, change the default administrator credentials immediately. For I-doit open versions 25 and below, change the default administrator credentials immediately. As a temporary workaround, consider restricting access to the administrator account until the issue is resolved.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-37755

Affected Products

I-Doit Open

I-Doit Pro

References · 10

• 🔥 https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/blob/main/README.md · Exploit
• 🔥 https://medium.com/@ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055 · Exploit
• 🔥 https://medium.com/@ray.999/d7a54030e055 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-37755 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37755 · Vendor Advisory
• https://twitter.com/CVEnew/status/1702416075567366294 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1700762874572853479 · Twitter Post
• https://t.me/cibsecurity/70563 · Telegram Post
• https://medium.com/%40ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055 · Note
• https://medium.com/%40ray.999/d7a54030e055 · Note