CVE-2023-41920 - Vulnerability Details - OpenCVE

The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00104.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2023-46397	The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273

History

No history.

MITRE

Status: PUBLISHED

Assigner: NCSC-NL

Published: 2024-07-02T07:42:24.484Z

Updated: 2024-08-02T19:09:49.386Z

Reserved: 2023-09-05T10:14:50.216Z

Link: CVE-2023-41920

Vulnrichment

Updated: 2024-08-02T19:09:49.386Z

NVD

Status : Awaiting Analysis

Published: 2024-07-02T08:15:03.950

Modified: 2024-11-21T08:21:55.490

Link: CVE-2023-41920

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-41920", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "state": "PUBLISHED", "assignerShortName": "NCSC-NL", "dateReserved": "2023-09-05T10:14:50.216Z", "datePublished": "2024-07-02T07:42:24.484Z", "dateUpdated": "2024-08-02T19:09:49.386Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2024-07-02T08:20:30.865Z"}, "title": "Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "affected": [{"vendor": "Kiloview", "product": "P1/P2", "versions": [{"status": "affected", "version": "All", "lessThanOrEqual": "4.8.2605", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability allows attackers access to the root account without having to authenticate. </span><span style=\"background-color: rgba(255, 255, 255, 0.7);\">Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.</span>\n\n"}]}], "references": [{"url": "https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "kiloview", "product": "p1_4g_video_encoder_firmware", "cpes": ["cpe:2.3:o:kiloview:p1_4g_video_encoder_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}, {"vendor": "kiloview", "product": "p2_4g_video_encoder_firmware", "cpes": ["cpe:2.3:o:kiloview:p2_4g_video_encoder_firmware:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "*", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-02T10:52:36.148784Z", "id": "CVE-2023-41920", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T10:52:42.017Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:09:49.386Z"}, "title": "CVE Program Container", "references": [{"url": "https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:09:49.386Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-41920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-02T10:52:36.148784Z"}}}], "affected": [{"cpes": ["cpe:2.3:o:kiloview:p1_4g_video_encoder_firmware:-:*:*:*:*:*:*:*"], "vendor": "kiloview", "product": "p1_4g_video_encoder_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:o:kiloview:p2_4g_video_encoder_firmware:-:*:*:*:*:*:*:*"], "vendor": "kiloview", "product": "p2_4g_video_encoder_firmware", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-02T10:52:28.203Z"}}], "cna": {"title": "Authentication Bypass by Primary Weakness in Kiloview P1/P2 devices", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Kiloview", "product": "P1/P2", "versions": [{"status": "affected", "version": "All", "versionType": "custom", "lessThanOrEqual": "4.8.2605"}], "defaultStatus": "affected"}], "references": [{"url": "https://advisories.ncsc.nl/advisory?id=NCSC-2024-0273"}], "descriptions": [{"lang": "en", "value": "The vulnerability allows attackers access to the root account without having to authenticate. Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">The vulnerability allows attackers access to the root account without having to authenticate. </span><span style=\"background-color: rgba(255, 255, 255, 0.7);\">Specifically, if the device is configured with the IP address of 10.10.10.10, the root user is automatically logged in.</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305 Authentication Bypass by Primary Weakness"}]}], "providerMetadata": {"orgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "shortName": "NCSC-NL", "dateUpdated": "2024-07-02T08:20:30.865Z"}}}, "cveMetadata": {"cveId": "CVE-2023-41920", "state": "PUBLISHED", "dateUpdated": "2024-08-02T19:09:49.386Z", "dateReserved": "2023-09-05T10:14:50.216Z", "assignerOrgId": "cf4a7ff5-dd38-4ede-a530-ffaa7ea59c39", "datePublished": "2024-07-02T07:42:24.484Z", "assignerShortName": "NCSC-NL"}, "dataVersion": "5.1"}