Cyber Resilience

CVE-2023-2645

CriticalPublic PoC

Published: 11 May 2023

Published
11 May 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1153 93.8th percentile
Risk Priority 27 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-2645 is a critical-severity Use of Hard-coded Password (CWE-259) vulnerability in Usr Usr-G806 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A critical vulnerability identified as CVE-2023-2645 affects the web management page component of the USR USR-G806 device running firmware version 1.0.41. The issue stems from use of a hard-coded password (CWE-259), where supplying the value "root" for the username or password argument allows authentication bypass. The flaw carries a CVSS 3.1 score of 9.8 and can be triggered remotely over the network without any credentials or user interaction.

An unauthenticated attacker can exploit the weakness to obtain full administrative access to the device, resulting in complete compromise of confidentiality, integrity, and availability. Public proof-of-concept material has already been released, enabling straightforward remote attacks against exposed instances.

The vendor was notified prior to disclosure but did not respond, and the only recommended mitigation is to alter the affected configuration settings. The associated EPSS score has remained essentially flat near 0.115 since publication, indicating no significant surge in observed exploitation interest.

EU & UK References

Vulnerability details

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password.…

more

It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

usr
usr-g806 firmware
1.0.41

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-259

Changing default authenticators prior to first use directly prevents use of hard-coded passwords.

addresses: CWE-259

Shared threat data frequently highlights products or deployments still using hard-coded passwords, enabling remediation that directly blocks credential-based attacks.

addresses: CWE-259

Background checks and authorization requirements decrease the probability that a developer will hard-code passwords for later unauthorized access.

addresses: CWE-259

Reviews of supplier deliverables reduce the chance that hard-coded passwords are introduced into the system.

References