CVE-2023-47213

C-first Cfr-1004ea Firmware vulnerability

9.8 CRITICALEPSS 1.09%

Published16 Nov 2023

Description

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

C-first Cfr-1004ea Firmwareall versions

C-first Cfr-1008ea Firmwareall versions

C-first Cfr-1016ea Firmwareall versions

C-first Cfr-16eaa Firmwareall versions

C-first Cfr-16eab Firmwareall versions

C-first Cfr-16eha Firmwareall versions

C-first Cfr-16ehd Firmwareall versions

C-first Cfr-4eaa Firmwareall versions

C-first Cfr-4eaam Firmwareall versions

C-first Cfr-4eabc Firmwareall versions

C-first Cfr-4eab Firmwareall versions

C-first Cfr-4eha Firmwareall versions

C-first Cfr-4ehd Firmwareall versions

C-first Cfr-8eaa Firmwareall versions

C-first Cfr-8eab Firmwareall versions

C-first Cfr-8eha Firmwareall versions

C-first Cfr-8ehd Firmwareall versions

C-first Cfr-904e Firmwareall versions

C-first Cfr-908e Firmwareall versions

C-first Cfr-916e Firmwareall versions

C-first Md-404aa Firmwareall versions

C-first Md-404ab Firmwareall versions

C-first Md-404ha Firmwareall versions

C-first Md-404hd Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Frequently asked

Is CVE-2023-47213 being actively exploited?

CVE-2023-47213 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.09%.

How severe is CVE-2023-47213?

CVE-2023-47213 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 1.09% probability of exploitation.

Which products are affected by CVE-2023-47213?

Affected products include C-first Cfr-1004ea Firmware, C-first Cfr-1008ea Firmware, C-first Cfr-1016ea Firmware, C-first Cfr-16eaa Firmware, C-first Cfr-16eab Firmware, and 19 more.

How do I fix CVE-2023-47213?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-47213 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.