CVE-2023-49255: fallo crítico en Hongdian H8951-4G-ESP
Router console accessible without authentication
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 0.7%
The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Hongdian · H8951-4G-ESPCVEs relacionadas — Hongdian H8951-4G-ESP
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-49254HIGHCommand injection in the network test toolsEPSS 0.7%CVE-2023-49262CRITICALBuffer overflow vulnerability in Cookie authentication fieldEPSS 0.7%CVE-2023-49253CRITICALPredefined root passwordEPSS 0.6%CVE-2023-49261HIGHSensitive authentication-related value accessible publiclyEPSS 0.5%CVE-2023-49256HIGHPredictable encryption passphrase used in publicly accessible configuration fileEPSS 0.5%CVE-2023-49258MEDIUMReflected cross-site scripting vulnerabilityEPSS 0.3%