PT-2023-30368 · First · Cfr-8Eab+4

Yoshiki Mori · Published 2023-11-16 · Updated 2024-10-21 · CVE-2023-47213

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions First Corporation's DVRs versions of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB (affected versions not specified, but updates are provided only for Late models)

Description The issue is related to a hard-coded password in First Corporation's DVRs, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device.

Recommendations For Late models of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB, apply the available updates. For other products, apply the provided workaround. As a temporary workaround, consider restricting access to the device's configuration information until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-47213

Affected Products

Cfr-16Eab

Cfr-4Eab

Cfr-8Eab

Md-404Ab

Md-808Ab

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-47213 · Security Note
• https://c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf · Vendor Advisory
• https://c-first.co.jp/information/ddososhirase · Vendor Advisory
• https://jvn.jp/en/vu/JVNVU99077347 · Note
• https://t.me/cvenotify/98963 · Telegram Post
• https://t.me/cvenotify/62379 · Telegram Post