CVE-2023-37755 : i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).

Published 2023-09-14 20:15:10

Updated 2023-09-19 13:41:44

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2023-37755

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-37755

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2023-37755

https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/blob/main/README.md

CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/README.md at main · leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below · GitHub
Exploit;Third Party Advisory
https://medium.com/@ray.999/d7a54030e055

i-doit v25 and below incorrect access control issue, CVE-2023–37755 - Ray - Medium
Exploit;Third Party Advisory
https://medium.com/@ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055

i-doit v25 and below incorrect access control issue, CVE-2023–37755 - Ray - Medium
Exploit;Third Party Advisory

Products affected by CVE-2023-37755

I-doit » I-doit » PRO Edition
Versions up to, including, (<=) 25
cpe:2.3:a:i-doit:i-doit:*:*:*:*:pro:*:*:*
Matching versions
I-doit » I-doit » Open Edition
Versions up to, including, (<=) 25
cpe:2.3:a:i-doit:i-doit:*:*:*:*:open:*:*:*
Matching versions

Vulnerability Details : CVE-2023-37755

Exploit prediction scoring system (EPSS) score for CVE-2023-37755

CVSS scores for CVE-2023-37755

CWE ids for CVE-2023-37755

References for CVE-2023-37755

Products affected by CVE-2023-37755