PT-2023-26390 · Rigol · Rigol Mso5000

Kriive · Published 2023-07-16 · Updated 2024-10-30 · CVE-2023-38379

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RIGOL MSO5000 digital oscilloscope version 00.01.03.00.03

Description The issue allows remote attackers to change the admin password via a zero-length password to the "webcontrol changepwd.cgi" application. This means the entered password only needs to match the first zero characters of the saved password.

Recommendations For RIGOL MSO5000 digital oscilloscope version 00.01.03.00.03, consider disabling access to the webcontrol changepwd.cgi application until a patch is available. Restrict access to the admin interface to minimize the risk of exploitation. Avoid using the default admin password and ensure that all passwords are complex and not easily guessable.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2023-38379

Affected Products

Rigol Mso5000

References · 6

• 🔥 https://tortel.li/post/insecure-scope · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38379 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38379 · Vendor Advisory
• https://t.me/cvenotify/100051 · Telegram Post
• https://t.me/cvenotify/54464 · Telegram Post
• https://news.ycombinator.com/item?id=36745664 · Note