CVE-2023-38026 - Vulnerability Details - OpenCVE

SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00423.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Myspotcam	Fhd 2 Fhd 2 Firmware
Spotcam Co Ltd	Spotcam Fhd2

Configuration 1 [-]

AND

cpe:2.3:o:myspotcam:fhd_2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:myspotcam:fhd_2:-:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

Update firmware version to 1.0039 or later.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html

History

Wed, 02 Oct 2024 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spotcam Co Ltd Spotcam Co Ltd spotcam Fhd2
CPEs		cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2::::::::
Vendors & Products		Spotcam Co Ltd Spotcam Co Ltd spotcam Fhd2
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2023-08-28T03:29:08.582Z

Updated: 2024-10-02T14:59:17.672Z

Reserved: 2023-07-12T00:37:03.717Z

Link: CVE-2023-38026

Vulnrichment

Updated: 2024-08-02T17:23:27.886Z

NVD

Status : Modified

Published: 2023-08-28T04:15:16.807

Modified: 2024-11-21T08:12:42.007

Link: CVE-2023-38026

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38026", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-07-12T00:37:03.717Z", "datePublished": "2023-08-28T03:29:08.582Z", "dateUpdated": "2024-10-02T14:59:17.672Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SpotCam FHD 2", "vendor": "SPOTCAM CO., LTD.", "versions": [{"status": "affected", "version": "1.0036"}]}], "datePublic": "2023-08-31T01:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.</span>\n\n"}], "value": "\nSpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.\n\n"}], "impacts": [{"capecId": "CAPEC-70", "descriptions": [{"lang": "en", "value": "CAPEC-70: Try Common or Default Usernames and Passwords"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:29:08.582Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n\n\nUpdate firmware version to 1.0039 or later.<br>"}], "value": "\n\n\nUpdate firmware version to 1.0039 or later.\n"}], "source": {"advisory": "TVN-202308006", "discovery": "EXTERNAL"}, "title": "SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.886Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "spotcam_co_ltd", "product": "spotcam_fhd2", "cpes": ["cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.0036", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-02T14:58:11.203478Z", "id": "CVE-2023-38026", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:59:17.672Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.886Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-38026", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-02T14:58:11.203478Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:spotcam_co_ltd:spotcam_fhd2:*:*:*:*:*:*:*:*"], "vendor": "spotcam_co_ltd", "product": "spotcam_fhd2", "versions": [{"status": "affected", "version": "1.0036"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-02T14:59:12.739Z"}}], "cna": {"title": "SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2", "source": {"advisory": "TVN-202308006", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-70", "descriptions": [{"lang": "en", "value": "CAPEC-70: Try Common or Default Usernames and Passwords"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SPOTCAM CO., LTD.", "product": "SpotCam FHD 2", "versions": [{"status": "affected", "version": "1.0036"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\n\n\nUpdate firmware version to 1.0039 or later.\n", "supportingMedia": [{"type": "text/html", "value": "\n\n\n\nUpdate firmware version to 1.0039 or later.<br>", "base64": false}]}], "datePublic": "2023-08-31T01:00:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nSpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:29:08.582Z"}}}, "cveMetadata": {"cveId": "CVE-2023-38026", "state": "PUBLISHED", "dateUpdated": "2024-10-02T14:59:17.672Z", "dateReserved": "2023-07-12T00:37:03.717Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2023-08-28T03:29:08.582Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}