CVE-2023-47800

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to perform remote code execution, data exfiltration, or other nefarious actions such as tampering with data or destroying/disrupting MSSQL services.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Nov 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-478014.7An issue was discovered in Click Studios Passwordstate before 9811. Existing users (Security Administrators) could use the System Wide API KCVE-2023-478027.2A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the IP blocCVE-2023-478035.3A vulnerability regarding improper limitation of a pathname to a restricted directory ('Path Traversal') is found in the Language Settings fCVE-2023-478048.8Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this pCVE-2023-478059.8Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.ThisCVE-2023-478068.8Cross-Site Request Forgery (CSRF) vulnerability in Saint Systems Disable User Login.This issue affects Disable User Login: from n/a through CVE-2023-478074.3Missing Authorization vulnerability in 10Web 10WebAnalytics wd-google-analytics allows Exploiting Incorrectly Configured Access Control SecuCVE-2023-478085.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plCVE-2023-478095.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 veCVE-2023-47817.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873.CVE-2023-478105.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin CVE-2023-478115.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Em