CVE-2023-41920

Published: Jul 2, 2024Modified: Jun 17, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: cert@ncsc.nl (Secondary)

Description

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.

Related CWEs

CWE-305

Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

References (2)

https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273

Source: cert@ncsc.nl

https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.