Cyber Resilience

CVE-2023-2645

Exposed Creds in Usr-G806 Firmware 1.0.41

Public PoCExposed Creds
Published
11 May 2023
Modified
21 November 2024
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.032 87th percentile
Risk Priority 81 floored blend · peak EPSS

Summary

CVE-2023-2645 is a critical-severity Use of Hard-coded Password (CWE-259) vulnerability in Usr Usr-G806 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked in the top 13% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

A critical vulnerability identified as CVE-2023-2645 affects the web management page component of the USR USR-G806 device running firmware version 1.0.41. The issue stems from use of a hard-coded password (CWE-259), where supplying the value "root" for the username or password argument allows authentication bypass. The flaw carries a CVSS 3.1 score of 9.8 and can be triggered remotely over the network without any credentials or user interaction.

An unauthenticated attacker can exploit the weakness to obtain full administrative access to the device, resulting in complete compromise of confidentiality, integrity, and availability. Public proof-of-concept material has already been released, enabling straightforward remote attacks against exposed instances.

The vendor was notified prior to disclosure but did not respond, and the only recommended mitigation is to alter the affected configuration settings. The associated EPSS score has remained essentially flat near 0.115 since publication, indicating no significant surge in observed exploitation interest.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password.…

more

It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-22055Shared CWE-259
CVE-2024-7159Shared CWE-259
CVE-2024-2197Shared CWE-259
CVE-2025-25428Shared CWE-259
CVE-2026-20316Shared CWE-259
CVE-2026-35905Shared CWE-259
CVE-2026-7251Shared CWE-259
CVE-2025-47823Shared CWE-259
CVE-2025-27638Shared CWE-259
CVE-2024-2038Shared CWE-259

Affected Assets

usr
usr-g806 firmware
1.0.41

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-259

Changing default authenticators prior to first use directly prevents use of hard-coded passwords.

addresses: CWE-259

Shared threat data frequently highlights products or deployments still using hard-coded passwords, enabling remediation that directly blocks credential-based attacks.

addresses: CWE-259

Background checks and authorization requirements decrease the probability that a developer will hard-code passwords for later unauthorized access.

addresses: CWE-259

Reviews of supplier deliverables reduce the chance that hard-coded passwords are introduced into the system.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prohibit embedding credentials in source code or binaries.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring users to change temporary or default passwords at first use stops the continued existence of hard-coded or guessable passwords that are shipped with the product.

References