CVE-2023-47213
Critical
Description
First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
SeverityCritical
CVSS9.8
Exploit probability—
ProductC-first Cfr-16eab Firmware
PublishedNov 16, 2023
First seenNov 16, 2023
Weakness typeCWE-798Hard-coded credentials
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| c-first cfr-16eab_firmware | No range specified | — |
| c-first cfr-1004ea_firmware | No range specified | — |
| c-first cfr-1008ea_firmware | No range specified | — |
| c-first cfr-1016ea_firmware | No range specified | — |
| c-first cfr-16eaa_firmware | No range specified | — |
| c-first cfr-16eha_firmware | No range specified | — |
| c-first cfr-16ehd_firmware | No range specified | — |
| c-first cfr-4eaa_firmware | No range specified | — |
| c-first cfr-4eaam_firmware | No range specified | — |
| c-first cfr-4eab_firmware | No range specified | — |
| c-first cfr-4eabc_firmware | No range specified | — |
| c-first cfr-4eha_firmware | No range specified | — |
| c-first cfr-4ehd_firmware | No range specified | — |
| c-first cfr-8eaa_firmware | No range specified | — |
| c-first cfr-8eab_firmware | No range specified | — |
| c-first cfr-8eha_firmware | No range specified | — |
| c-first cfr-8ehd_firmware | No range specified | — |
| c-first cfr-904e_firmware | No range specified | — |
| c-first cfr-908e_firmware | No range specified | — |
| c-first cfr-916e_firmware | No range specified | — |
| c-first md-404aa_firmware | No range specified | — |
| c-first md-404ab_firmware | No range specified | — |
| c-first md-404ha_firmware | No range specified | — |
| c-first md-404hd_firmware | No range specified | — |
| c-first md-808aa_firmware | No range specified | — |
| c-first md-808ab_firmware | No range specified | — |
| c-first md-808ha_firmware | No range specified | — |
| c-first md-808hd_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.