CVE-2023-47213

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
First Co., Ltd.	CFR-904E, CFR-908E, CFR-916E	firmware all versions
First Co., Ltd.	CFR-4EHD, CFR-8EHD, CFR-16EHD	firmware all versions
First Co., Ltd.	CFR-4EHA, CFR-8EHA, CFR-16EHA	firmware all versions
First Co., Ltd.	CFR-4EAAM, CFR-4EABC	firmware all versions
First Co., Ltd.	CFR-4EAA, CFR-8EAA, CFR-16EAA	firmware all versions
First Co., Ltd.	CFR-4EAB, CFR-8EAB, CFR-16EAB	firmware all versions
First Co., Ltd.	CFR-1004EA, CFR-1008EA, CFR-1016EA	firmware all versions
First Co., Ltd.	MD-404HD, MD-808HD	firmware all versions
First Co., Ltd.	MD-404HA, MD-808HA	firmware all versions
First Co., Ltd.	MD-404AA, MD-808AA	firmware all versions
First Co., Ltd.	MD-404AB, MD-808AB	firmware all versions
c-first	md-808hd_firmware	< *

References

https://jvn.jp/en/vu/JVNVU99077347/Third Party Advisory
https://www.c-first.co.jp/information/ddososhirase/Vendor Advisory
https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdfVendor Advisory
https://jvn.jp/en/vu/JVNVU99077347/Third Party Advisory
https://www.c-first.co.jp/information/ddososhirase/Vendor Advisory
https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdfVendor Advisory

Timeline

Published: Nov 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-472155.4Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this CVE-2023-472165.5in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through occupy all resources CVE-2023-472175.5in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow.CVE-2023-472188.3An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2023-472198.8A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject CVE-2023-47225.5Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV.CVE-2023-472206.6An OS command injection vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow authen CVE-2023-472214.9A path traversal vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated administ CVE-2023-472229.8An exposure of sensitive information vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could CVE-2023-472234.8Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.CVE-2023-472247.5Missing Authorization vulnerability in WP Travel WP Travel wp-travel allows Exploiting Incorrectly Configured Access Control Security Levels CVE-2023-472255.4Missing Authorization vulnerability in KaizenCoders Short URL shorten-url allows Exploiting Incorrectly Configured Access Control Security L