CVE-2023-2645
Published: 11 May 2023
Summary
CVE-2023-2645 is a critical-severity Use of Hard-coded Password (CWE-259) vulnerability in Usr Usr-G806 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 6.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A critical vulnerability identified as CVE-2023-2645 affects the web management page component of the USR USR-G806 device running firmware version 1.0.41. The issue stems from use of a hard-coded password (CWE-259), where supplying the value "root" for the username or password argument allows authentication bypass. The flaw carries a CVSS 3.1 score of 9.8 and can be triggered remotely over the network without any credentials or user interaction.
An unauthenticated attacker can exploit the weakness to obtain full administrative access to the device, resulting in complete compromise of confidentiality, integrity, and availability. Public proof-of-concept material has already been released, enabling straightforward remote attacks against exposed instances.
The vendor was notified prior to disclosure but did not respond, and the only recommended mitigation is to alter the affected configuration settings. The associated EPSS score has remained essentially flat near 0.115 since publication, indicating no significant surge in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34111
Vulnerability details
A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password.…
more
It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Changing default authenticators prior to first use directly prevents use of hard-coded passwords.
Shared threat data frequently highlights products or deployments still using hard-coded passwords, enabling remediation that directly blocks credential-based attacks.
Background checks and authorization requirements decrease the probability that a developer will hard-code passwords for later unauthorized access.
Reviews of supplier deliverables reduce the chance that hard-coded passwords are introduced into the system.