CVE-2023-49253CWE-798

Predefined root password

Critical · published January 12, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

🚨 A hardcoded root password just chilling in your device? That's like giving your house keys to a stranger and saying, 'Don’t worry, they won’t use them!' 🔥 Imagine if a hotel gave everyone checked in the same master key — it wouldn’t just be a security nightmare, it would be chaos! This hardcoded password is like that master key, granting access to anyone who knows where to look. An attacker could waltz right in with the root credentials, giving them complete control — they could read sensitive data, modify settings, or even lock you out entirely. The consequences could be absolutely devastating for your security posture!

Put simply

Imagine if a hotel gave everyone checked in the same master key — it wouldn’t just be a security nightmare, it would be chaos! This hardcoded password is like that master key, granting access to anyone who knows where to look. This vulnerability arises because the root user password is embedded in the device's firmware and cannot be altered through the user interface, making it a prime target for exploitation.

What to do

An attacker could waltz right in with the root credentials, giving them complete control — they could read sensitive data, modify settings, or even lock you out entirely. The consequences could be absolutely devastating for your security posture! Immediately check if your device is affected and reach out to the manufacturer for an update or patch. If no fix is available, consider taking the device offline until you can secure it properly. Stay vigilant! You got this! By taking action now, you can protect your system from potential threats. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00556 · 45.6th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-01-12T14:23Z
EPSS history
Timeline
  • 12 JAN 14:23Z
    Predefined root password
    cvelistv5