CVE-2023-2504 : Files present on firmware images could allow an attacker to gain unauthorized ac

Files present on firmware images could allow an attacker to gain unauthorized access as a root user using hard-coded credentials.

Published 2023-05-22 22:15:10

Updated 2023-05-31 14:07:28

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Bypass

Products affected by CVE-2023-2504

Birddog » A300 Firmware » Version: 3.4
cpe:2.3:o:birddog:a300_firmware:3.4:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » A300 » Version: N/A
Birddog » Mini Firmware » Version: 2.6.2
cpe:2.3:o:birddog:mini_firmware:2.6.2:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » Mini » Version: N/A
Birddog » 4k Quad Firmware » Version: 4.5.181
cpe:2.3:o:birddog:4k_quad_firmware:4.5.181:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » 4k Quad » Version: N/A
Birddog » 4k Quad Firmware » Version: 4.5.196
cpe:2.3:o:birddog:4k_quad_firmware:4.5.196:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » 4k Quad » Version: N/A
Birddog » Studio R3 Firmware » Version: 3.6.4
cpe:2.3:o:birddog:studio_r3_firmware:3.6.4:*:*:*:*:*:*:*
Matching versions
When used together with: Birddog » Studio R3 » Version: N/A

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 19 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
8.4	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	2.5	5.9	ICS-CERT
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: ics-cert@hq.dhs.gov (Primary)

Jump to