CVE-2023-47213

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

VendorProductVersions
First Co., Ltd.CFR-904E, CFR-908E, CFR-916Efirmware all versions
First Co., Ltd.CFR-4EHD, CFR-8EHD, CFR-16EHDfirmware all versions
First Co., Ltd.CFR-4EHA, CFR-8EHA, CFR-16EHAfirmware all versions
First Co., Ltd.CFR-4EAAM, CFR-4EABCfirmware all versions
First Co., Ltd.CFR-4EAA, CFR-8EAA, CFR-16EAAfirmware all versions
First Co., Ltd.CFR-4EAB, CFR-8EAB, CFR-16EABfirmware all versions
First Co., Ltd.CFR-1004EA, CFR-1008EA, CFR-1016EAfirmware all versions
First Co., Ltd.MD-404HD, MD-808HDfirmware all versions
First Co., Ltd.MD-404HA, MD-808HAfirmware all versions
First Co., Ltd.MD-404AA, MD-808AAfirmware all versions
First Co., Ltd.MD-404AB, MD-808ABfirmware all versions
c-firstmd-808hd_firmware< *

References

Timeline

Published
Nov 16, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-472155.4Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If thisCVE-2023-472165.5in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resourcesCVE-2023-472175.5in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.CVE-2023-472188.3An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability coCVE-2023-472198.8A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to injectCVE-2023-47225.5Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-472206.6An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authenCVE-2023-472214.9A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administCVE-2023-472229.8An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability couldCVE-2023-472234.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.CVE-2023-472247.5Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security LevelsCVE-2023-472255.4Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security L