CVE-2023-39169 : The affected devices use publicly available default credentials with administrat

The affected devices use publicly available default credentials with administrative privileges.

Published 2023-12-07 15:15:08

Updated 2024-01-25 20:34:51

Source CERT VDE

View at NVD, CVE.org

Products affected by CVE-2023-39169

Enbw » Senec Storage Box Firmware » Version: N/A
cpe:2.3:o:enbw:senec_storage_box_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Enbw » Senec Storage Box » Version: V1

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 11 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	CERT VDE
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.
Assigned by:
- info@cert.vde.com (Secondary)
- nvd@nist.gov (Primary)
CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Assigned by: info@cert.vde.com (Primary)

https://seclists.org/fulldisclosure/2023/Nov/3

Full Disclosure: Senec Inverters Home V1, V2, V3 Home & Hybrid Publicly Accessible Default Credentials- CVE-2023-39170
Mailing List;Not Applicable;Third Party Advisory

Jump to