Paper/Archive/CVE-2023-2645

CVE-2023-2645

USR USR-G806 — USR USR-G806 Web Management Page hard-coded password

CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.0.880 × 2017.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

ProductAffectedFixed inSource

USR-G8061.0.41–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

writeupvuldb.com/?id.228774 refvuldb.com/?ctiid.228774 exploitgithub.com/wswokao/testrouter/blob/main/README.md