PT-2024-13710 · Device · Device

Robert Pogorzelski · Published 2024-01-12 · Updated 2025-06-11 · CVE-2023-49253

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Device (affected versions not specified)

Description The root user password is hardcoded into the device and cannot be changed in the user interface. Additionally, there is an issue where a user's browser may be forced to execute JavaScript and pass the authentication cookie to an attacker, leveraging an XSS vulnerability located at "/gui/terminal tool.cgi" in the data parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-49253

Affected Products

Device

References · 16

• https://osv.dev/vulnerability/CVE-2023-49253 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49253 · Security Note
• https://t.me/cvenotify/97794 · Telegram Post
• https://t.me/cvenotify/97795 · Telegram Post
• https://t.me/cvenotify/125409 · Telegram Post
• https://t.me/cvenotify/67970 · Telegram Post
• https://cert.pl/en/posts/2024/01/CVE-2023-49253 · Note
• https://t.me/cvenotify/113193 · Telegram Post
• https://t.me/cvenotify/67924 · Telegram Post
• https://t.me/cvenotify/67969 · Telegram Post
• https://twitter.com/CVEnew/status/1745818708570984649 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1745864760338399664 · Twitter Post
• https://t.me/cvenotify/97791 · Telegram Post
• https://t.me/cvenotify/97792 · Telegram Post
• https://t.me/cvenotify/97793 · Telegram Post