CVE-2023-47800
Critical
Description
Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNatus Neuroworks Eeg
PublishedNov 10, 2023
First seenNov 10, 2023
How to fix
Update
- natus neuroworks_eeg8.4 or later
- natus sleepworks8.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| natus neuroworks_eeg | v < 8.4, 8.4 | 8.4 |
| natus sleepworks | v < 8.4, 8.4 | 8.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.