OpenCVE

SpotCam Co., Ltd. SpotCam FHD 2’s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Myspotcam	Fhd 2 Fhd 2 Firmware
Spotcam Co Ltd	Spotcam Fhd2

Configuration 1 [-]

AND

cpe:2.3:o:myspotcam:fhd_2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:myspotcam:fhd_2:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html

History

Wed, 02 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spotcam Co Ltd Spotcam Co Ltd spotcam Fhd2
CPEs		cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2::::::::
Vendors & Products		Spotcam Co Ltd Spotcam Co Ltd spotcam Fhd2
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2023-08-28T03:14:20.410Z

Updated: 2024-10-02T15:01:18.201Z

Reserved: 2023-07-12T00:37:03.716Z

Link: CVE-2023-38024

Vulnrichment

Updated: 2024-08-02T17:23:27.887Z

NVD

Status : Modified

Published: 2023-08-28T04:15:14.783

Modified: 2024-11-21T08:12:41.740

Link: CVE-2023-38024

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38024", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-07-12T00:37:03.716Z", "datePublished": "2023-08-28T03:14:20.410Z", "dateUpdated": "2024-10-02T15:01:18.201Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SpotCam FHD 2", "vendor": "SPOTCAM CO., LTD.", "versions": [{"status": "affected", "version": "1.0036"}]}], "datePublic": "2023-08-31T01:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.</span>\n\n"}], "value": "\nSpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.\n\n"}], "impacts": [{"capecId": "CAPEC-70", "descriptions": [{"lang": "en", "value": "CAPEC-70 Try Common or Default Usernames and Passwords"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:14:20.410Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update firmware version to 1.0039 or later. "}], "value": "Update firmware version to 1.0039 or later.\u00a0"}], "source": {"advisory": "TVN-202308004", "discovery": "EXTERNAL"}, "title": "SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.887Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "spotcam_co_ltd", "product": "spotcam_fhd2", "cpes": ["cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.0036", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T15:00:46.545506Z", "id": "CVE-2023-38024", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T15:01:18.201Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.887Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T15:00:46.545506Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2:*:*:*:*:*:*:*:*"], "vendor": "spotcam_co_ltd", "product": "spotcam_fhd2", "versions": [{"status": "affected", "version": "1.0036"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T15:01:13.593Z"}}], "cna": {"title": "SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1", "source": {"advisory": "TVN-202308004", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-70", "descriptions": [{"lang": "en", "value": "CAPEC-70 Try Common or Default Usernames and Passwords"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SPOTCAM CO., LTD.", "product": "SpotCam FHD 2", "versions": [{"status": "affected", "version": "1.0036"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update firmware version to 1.0039 or later.\u00a0", "supportingMedia": [{"type": "text/html", "value": "Update firmware version to 1.0039 or later. ", "base64": false}]}], "datePublic": "2023-08-31T01:00:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7331-9099e-1.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2\u2019s hidden Telnet function has a vulnerability of using hard-coded Telnet credentials. An remote unauthenticated attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:14:20.410Z"}}}, "cveMetadata": {"cveId": "CVE-2023-38024", "state": "PUBLISHED", "dateUpdated": "2024-10-02T15:01:18.201Z", "dateReserved": "2023-07-12T00:37:03.716Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2023-08-28T03:14:20.410Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}