CVE-2023-38026 - OpenCVE

SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Myspotcam	Fhd 2 Fhd 2 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:myspotcam:fhd_2_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:myspotcam:fhd_2:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2023-08-28T03:29:08.582Z

Updated: 2024-08-02T17:23:27.886Z

Reserved: 2023-07-12T00:37:03.717Z

Link: CVE-2023-38026

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-08-28T04:15:16.807

Modified: 2023-08-29T16:25:12.783

Link: CVE-2023-38026

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-38026", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2023-07-12T00:37:03.717Z", "datePublished": "2023-08-28T03:29:08.582Z", "dateUpdated": "2024-08-02T17:23:27.886Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "SpotCam FHD 2", "vendor": "SPOTCAM CO., LTD.", "versions": [{"status": "affected", "version": "1.0036"}]}], "datePublic": "2023-08-31T01:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">SpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.</span>\n\n"}], "value": "\nSpotCam Co., Ltd. SpotCam FHD 2 has a vulnerability of using hard-coded uBoot credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service.\n\n"}], "impacts": [{"capecId": "CAPEC-70", "descriptions": [{"lang": "en", "value": "CAPEC-70: Try Common or Default Usernames and Passwords"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2023-08-28T03:29:08.582Z"}, "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n\n\nUpdate firmware version to 1.0039 or later.<br>"}], "value": "\n\n\nUpdate firmware version to 1.0039 or later.\n"}], "source": {"advisory": "TVN-202308006", "discovery": "EXTERNAL"}, "title": "SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T17:23:27.886Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-7333-972ca-1.html", "tags": ["x_transferred"]}]}]}}