Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-27573 is a critical-severity Use of Default Credentials (CWE-1392) vulnerability in Netboxlabs Netbox-Docker. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-27573 affects netbox-docker versions prior to 2.5.0, where a superuser account exists with default credentials: an admin password for the admin account and a hardcoded SUPERUSER_API_TOKEN value of 0123456789abcdef0123456789abcdef01234567. This configuration represents a CWE-1392 vulnerability, earning a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). The default token was intentionally included to support the product's primary use case of isolated development networks, but installation scripts did not enforce changes when users repurposed it for production environments, despite documentation warnings against using defaults.
Remote attackers can exploit this vulnerability by attempting authentication with the known default credentials, particularly the API token, over the network. On publicly exposed instances, while nearly all users reportedly changed the admin password, approximately 10% failed to update the token, enabling unauthenticated attackers with no privileges to gain superuser access. Successful exploitation grants high confidentiality, integrity, and availability impact across the changed scope, potentially allowing full compromise of the NetBox instance.
Mitigation involves upgrading to netbox-docker version 2.5.0 or later, as detailed in the project's GitHub release notes, which address the issue following community discussion in issue #953 and the corresponding pull request #959. The supplier was aware of the CVE assignment and raised no objections.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-31322
Vulnerability Data
netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token.…
more
Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V13.2.1
Mitigating Controls (NIST 800-53 r5) AI
Secure configuration settings establish baselines that prohibit default credentials on system components.
Authenticator management requires verification of identity and secure distribution of initial authenticators, directly stopping default credentials from being left in place.
Vulnerability scanning can discover default credentials after deployment but does not stop their introduction.
Cryptographic key management mandates proper establishment and handling instead of embedding keys in code.
Account management processes include assignment and control of initial account credentials, reducing the chance defaults remain active.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential management processes directly require replacing or disabling default passwords and keys.
Authentication policies can enforce non-default credential strength but do not explicitly address initial deployment defaults.
Hardened baselines and configuration management explicitly prohibit default credentials on deployed systems.
PR.AA-02 addresses human identity proofing and per-person credential issuance at enrollment; it has no bearing on whether developers embed static credentials in software.
PR.DS-01 addresses encryption and integrity of stored data but never touches credential or key management practices, so it neither prevents hard-coded credentials nor removes any of their risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Education on secure configuration practices discourages technical staff from embedding or relying on hard-coded credentials in systems and applications.