PT-2026-24575 · Unknown · Netbox-Docker

Published 2026-03-11 · Updated 2026-05-07 · CVE-2023-27573

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions netbox-docker versions prior to 2.5.0

Description The netbox-docker software, before version 2.5.0, includes a superuser account with default credentials. Specifically, the admin account has a default password, and the SUPERUSER API TOKEN is set to a hardcoded value of 0123456789abcdef0123456789abcdef01234567. While the default token was intentionally included for isolated development networks, approximately 90% of users did not change this default value, leaving systems exposed. The documentation for production use explicitly stated that these defaults should not be used, but the installation process did not enforce non-default values.

Recommendations Upgrade to netbox-docker version 2.5.0 or later. Change the default password for the admin account. Change the default value of the SUPERUSER API TOKEN.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-1392

Related Identifiers

CVE-2023-27573

Affected Products

Netbox-Docker

References · 10

• 🔥 https://github.com/netbox-community/netbox-docker/issues/953 · Exploit
• https://github.com/netbox-community/netbox-docker/pull/959 · Patch
• https://osv.dev/vulnerability/CVE-2023-27573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27573 · Security Note
• https://github.com/netbox-community/netbox-docker/releases/tag/2.5.0 · Note
• https://twitter.com/CveFindCom/status/2031621452995141819 · Twitter Post
• https://t.me/cveNotify/155045 · Telegram Post
• https://t.me/CVEtracker/47090 · Telegram Post
• https://twitter.com/0dayPublishing/status/2031605778965004634 · Twitter Post
• https://t.me/cveNotify/162605 · Telegram Post