CVE-2023-47213

Published: Nov 16, 2023Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

Affected (28)

Products: C First: Cfr 1004ea Firmware, Cfr 1008ea Firmware, Cfr 1016ea Firmware, Cfr 16eaa Firmware, Cfr 16eab Firmware, Cfr 16eha Firmware, Cfr 16ehd Firmware, Cfr 4eaa Firmware, Cfr 4eaam Firmware, Cfr 4eab Firmware, Cfr 4eabc Firmware, Cfr 4eha Firmware, Cfr 4ehd Firmware, Cfr 8eaa Firmware, Cfr 8eab Firmware, Cfr 8eha Firmware, Cfr 8ehd Firmware, Cfr 904e Firmware, Cfr 908e Firmware, Cfr 916e Firmware, Md 404aa Firmware, Md 404ab Firmware, Md 404ha Firmware, Md 404hd Firmware, Md 808aa Firmware, Md 808ab Firmware, Md 808ha Firmware, Md 808hd Firmware

28 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 1004ea Firmware	All versions

Running on/with	Platform Versions
C First Cfr 1004ea	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 1008ea Firmware	All versions

Running on/with	Platform Versions
C First Cfr 1008ea	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 1016ea Firmware	All versions

Running on/with	Platform Versions
C First Cfr 1016ea	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 16eaa Firmware	All versions

Running on/with	Platform Versions
C First Cfr 16eaa	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 16eab Firmware	All versions

Running on/with	Platform Versions
C First Cfr 16eab	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 16eha Firmware	All versions

Running on/with	Platform Versions
C First Cfr 16eha	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 16ehd Firmware	All versions

Running on/with	Platform Versions
C First Cfr 16ehd	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 4eaa Firmware	All versions

Running on/with	Platform Versions
C First Cfr 4eaa	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 4eaam Firmware	All versions

Running on/with	Platform Versions
C First Cfr 4eaam	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 4eab Firmware	All versions

Running on/with	Platform Versions
C First Cfr 4eab	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 4eabc Firmware	All versions

Running on/with	Platform Versions
C First Cfr 4eabc	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 4eha Firmware	All versions

Running on/with	Platform Versions
C First Cfr 4eha	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 4ehd Firmware	All versions

Running on/with	Platform Versions
C First Cfr 4ehd	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 8eaa Firmware	All versions

Running on/with	Platform Versions
C First Cfr 8eaa	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 8eab Firmware	All versions

Running on/with	Platform Versions
C First Cfr 8eab	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 8eha Firmware	All versions

Running on/with	Platform Versions
C First Cfr 8eha	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 8ehd Firmware	All versions

Running on/with	Platform Versions
C First Cfr 8ehd	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 904e Firmware	All versions

Running on/with	Platform Versions
C First Cfr 904e	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 908e Firmware	All versions

Running on/with	Platform Versions
C First Cfr 908e	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Cfr 916e Firmware	All versions

Running on/with	Platform Versions
C First Cfr 916e	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 404aa Firmware	All versions

Running on/with	Platform Versions
C First Md 404aa	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 404ab Firmware	All versions

Running on/with	Platform Versions
C First Md 404ab	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 404ha Firmware	All versions

Running on/with	Platform Versions
C First Md 404ha	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 404hd Firmware	All versions

Running on/with	Platform Versions
C First Md 404hd	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 808aa Firmware	All versions

Running on/with	Platform Versions
C First Md 808aa	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 808ab Firmware	All versions

Running on/with	Platform Versions
C First Md 808ab	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 808ha Firmware	All versions

Running on/with	Platform Versions
C First Md 808ha	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
C First Md 808hd Firmware	All versions

Running on/with	Platform Versions
C First Md 808hd	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (6)

https://jvn.jp/en/vu/JVNVU99077347/

Source: vultures@jpcert.or.jp

Third Party Advisory

https://www.c-first.co.jp/information/ddososhirase/

Source: vultures@jpcert.or.jp

Vendor Advisory

https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf

Source: vultures@jpcert.or.jp

Vendor Advisory

https://jvn.jp/en/vu/JVNVU99077347/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.c-first.co.jp/information/ddososhirase/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.