#VU83491 Use of Hard-coded Password in First Co. products - CVE-2023-47213

Vulnerability identifier: #VU83491

Vulnerability risk: High

CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-47213

CWE-ID: CWE-259

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
CFR-904E
Hardware solutions / Other hardware appliances
CFR-908E
Hardware solutions / Other hardware appliances
CFR-916E
Hardware solutions / Other hardware appliances
CFR-4EHD
Hardware solutions / Other hardware appliances
CFR-8EHD
Hardware solutions / Other hardware appliances
CFR-16EHD
Hardware solutions / Other hardware appliances
CFR-4EHA
Hardware solutions / Other hardware appliances
CFR-8EHA
Hardware solutions / Other hardware appliances
CFR-16EHA
Hardware solutions / Other hardware appliances
CFR-4EAAM
Hardware solutions / Other hardware appliances
CFR-4EABC
Hardware solutions / Other hardware appliances
CFR-4EAA
Hardware solutions / Other hardware appliances
CFR-8EAA
Hardware solutions / Other hardware appliances
CFR-16EAA
Hardware solutions / Other hardware appliances
CFR-4EAB
Hardware solutions / Other hardware appliances
CFR-8EAB
Hardware solutions / Other hardware appliances
CFR-16EAB
Hardware solutions / Other hardware appliances
CFR-1004EA
Hardware solutions / Other hardware appliances
CFR-1008EA
Hardware solutions / Other hardware appliances
CFR-1016EA
Hardware solutions / Other hardware appliances
MD-404HD
Hardware solutions / Other hardware appliances
MD-808HD
Hardware solutions / Other hardware appliances
MD-404HA
Hardware solutions / Other hardware appliances
MD-808HA
Hardware solutions / Other hardware appliances
MD-404AA
Hardware solutions / Other hardware appliances
MD-808AA
Hardware solutions / Other hardware appliances
MD-404AB
Hardware solutions / Other hardware appliances
MD-808AB
Hardware solutions / Other hardware appliances

Vendor: First Co.

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use a hard-coded password. A remote attacker can rewrite or obtain the configuration information of the target device.

Mitigation
Install updates from vendor's website for the following products.

• CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, MD-808AB

Vulnerable software versions

CFR-904E: All versions

CFR-908E: All versions

CFR-916E: All versions

CFR-4EHD: All versions

CFR-8EHD: All versions

CFR-16EHD: All versions

CFR-4EHA: All versions

CFR-8EHA: All versions

CFR-16EHA: All versions

CFR-4EAAM: All versions

CFR-4EABC: All versions

CFR-4EAA: All versions

CFR-8EAA: All versions

CFR-16EAA: All versions

CFR-4EAB: All versions

CFR-8EAB: All versions

CFR-16EAB: All versions

CFR-1004EA: All versions

CFR-1008EA: All versions

CFR-1016EA: All versions

MD-404HD: All versions

MD-808HD: All versions

MD-404HA: All versions

MD-808HA: All versions

MD-404AA: All versions

MD-808AA: All versions

MD-404AB: All versions

MD-808AB: All versions

---

External links
http://www.c-first.co.jp/information/ddososhirase/
http://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf
http://jvn.jp/en/vu/JVNVU99077347/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.