CVE-2023-2645

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-259

Affected software

No affected versions have been published.

Timeline

Published: May 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-264505.4The "OX Count" web service did not specify a media-type when processing responses by external resources. Malicious script code can be execut CVE-2023-264517.5Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. Authorizati CVE-2023-264528.8Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this CVE-2023-264538.8Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires a CVE-2023-264548.8Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requ CVE-2023-264557.8RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could CVE-2023-264565.4Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the CVE-2023-264576.1SAP Content Server - version 7.53, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerabilit CVE-2023-264588.7An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP CVE-2023-264597.4Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 7 CVE-2023-26464.5A vulnerability has been found in TP-Link Archer C7v2 v2_en_us_180114 and classified as problematic. Affected by this vulnerability is an un CVE-2023-264605.3Cache Management Service in SAP NetWeaver Application Server for Java - version 7.50, does not perform any authentication checks for functio