9.8

CVE-2023-47674

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
C-first ≫ Cfr-1004ea Firmware Version-
   C-first ≫ Cfr-1004ea Version-
C-first ≫ Cfr-1008ea Firmware Version-
   C-first ≫ Cfr-1008ea Version-
C-first ≫ Cfr-1016ea Firmware Version-
   C-first ≫ Cfr-1016ea Version-
C-first ≫ Cfr-16eaa Firmware Version-
   C-first ≫ Cfr-16eaa Version-
C-first ≫ Cfr-16eab Firmware Version-
   C-first ≫ Cfr-16eab Version-
C-first ≫ Cfr-16eha Firmware Version-
   C-first ≫ Cfr-16eha Version-
C-first ≫ Cfr-16ehd Firmware Version-
   C-first ≫ Cfr-16ehd Version-
C-first ≫ Cfr-4eaa Firmware Version-
   C-first ≫ Cfr-4eaa Version-
C-first ≫ Cfr-4eaam Firmware Version-
   C-first ≫ Cfr-4eaam Version-
C-first ≫ Cfr-4eab Firmware Version-
   C-first ≫ Cfr-4eab Version-
C-first ≫ Cfr-4eabc Firmware Version-
   C-first ≫ Cfr-4eabc Version-
C-first ≫ Cfr-4eha Firmware Version-
   C-first ≫ Cfr-4eha Version-
C-first ≫ Cfr-4ehd Firmware Version-
   C-first ≫ Cfr-4ehd Version-
C-first ≫ Cfr-8eaa Firmware Version-
   C-first ≫ Cfr-8eaa Version-
C-first ≫ Cfr-8eab Firmware Version-
   C-first ≫ Cfr-8eab Version-
C-first ≫ Cfr-8eha Firmware Version-
   C-first ≫ Cfr-8eha Version-
C-first ≫ Cfr-8ehd Firmware Version-
   C-first ≫ Cfr-8ehd Version-
C-first ≫ Cfr-904e Firmware Version-
   C-first ≫ Cfr-904e Version-
C-first ≫ Cfr-908e Firmware Version-
   C-first ≫ Cfr-908e Version-
C-first ≫ Cfr-916e Firmware Version-
   C-first ≫ Cfr-916e Version-
C-first ≫ Md-404aa Firmware Version-
   C-first ≫ Md-404aa Version-
C-first ≫ Md-404ab Firmware Version-
   C-first ≫ Md-404ab Version-
C-first ≫ Md-404ha Firmware Version-
   C-first ≫ Md-404ha Version-
C-first ≫ Md-404hd Firmware Version-
   C-first ≫ Md-404hd Version-
C-first ≫ Md-808aa Firmware Version-
   C-first ≫ Md-808aa Version-
C-first ≫ Md-808ab Firmware Version-
   C-first ≫ Md-808ab Version-
C-first ≫ Md-808ha Firmware Version-
   C-first ≫ Md-808ha Version-
C-first ≫ Md-808hd Firmware Version-
   C-first ≫ Md-808hd Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.02% 0.766
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.