CVE-2023-22906 : Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileg

Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.

Published 2023-07-04 00:15:09

Updated 2023-07-10 18:02:51

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-22906

Heroelectronix » Qubo Hcd01 Firmware » Version: 1.38 20220125
cpe:2.3:o:heroelectronix:qubo_hcd01_firmware:1.38_20220125:*:*:*:*:*:*:*
Matching versions
When used together with: Heroelectronix » Qubo Hcd01 » Version: N/A
Heroelectronix » Qubo Hcd02 Firmware » Version: 1.38 20220125
cpe:2.3:o:heroelectronix:qubo_hcd02_firmware:1.38_20220125:*:*:*:*:*:*:*
Matching versions
When used together with: Heroelectronix » Qubo Hcd02 » Version: N/A

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
8.8	HIGH	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Adjacent Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Assigned by: nvd@nist.gov (Primary)

https://twitter.com/ayyappan162010/status/1610764707753000960

Tweet / Twitter
Exploit;Third Party Advisory
https://github.com/nonamecoder/CVE-2023-22906

GitHub - nonamecoder/CVE-2023-22906
Exploit;Technical Description;Third Party Advisory

Jump to