Secuno
ENNL
Book demo

CVE-2023-47674

C-first Cfr-1004ea Firmware authentication bypass

9.8 CRITICALEPSS 1.26%
  1. Published16 Nov 2023

Description

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

C-first Cfr-1004ea Firmwareall versions
C-first Cfr-1008ea Firmwareall versions
C-first Cfr-1016ea Firmwareall versions
C-first Cfr-16eaa Firmwareall versions
C-first Cfr-16eab Firmwareall versions
C-first Cfr-16eha Firmwareall versions
C-first Cfr-16ehd Firmwareall versions
C-first Cfr-4eaa Firmwareall versions
C-first Cfr-4eaam Firmwareall versions
C-first Cfr-4eabc Firmwareall versions
C-first Cfr-4eab Firmwareall versions
C-first Cfr-4eha Firmwareall versions
C-first Cfr-4ehd Firmwareall versions
C-first Cfr-8eaa Firmwareall versions
C-first Cfr-8eab Firmwareall versions
C-first Cfr-8eha Firmwareall versions
C-first Cfr-8ehd Firmwareall versions
C-first Cfr-904e Firmwareall versions
C-first Cfr-908e Firmwareall versions
C-first Cfr-916e Firmwareall versions
C-first Md-404aa Firmwareall versions
C-first Md-404ab Firmwareall versions
C-first Md-404ha Firmwareall versions
C-first Md-404hd Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-876899.8
The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store…
CVE-2026-843138.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST…
CVE-2026-1095759.8
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition…
CVE-2026-571189.8
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59,…
CVE-2026-1093718.2
ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the…
CVE-2026-1085498.1
cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX…

Frequently asked

Is CVE-2023-47674 being actively exploited?

CVE-2023-47674 is not in the CISA KEV catalog. Its EPSS exploit probability is 1.26%.

How severe is CVE-2023-47674?

CVE-2023-47674 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 1.26% probability of exploitation.

Which products are affected by CVE-2023-47674?

Affected products include C-first Cfr-1004ea Firmware, C-first Cfr-1008ea Firmware, C-first Cfr-1016ea Firmware, C-first Cfr-16eaa Firmware, C-first Cfr-16eab Firmware, and 19 more.

How do I fix CVE-2023-47674?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2023-47674 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.