CVE-2023-49259
Crypto Weakness in Hongdian H8951-4G-Esp Firmware ≤ 2310271149
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-49259 is a high-severity Predictable from Observable State (CWE-341) vulnerability in Hongdian H8951-4G-Esp Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53261
- 🇵🇱 CERT-PL: cert.pl
- 🇵🇱 CERT-PL: cert.pl
Vulnerability Data
The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V6.6.1V6.5.3V6.5.8
Mitigating Controls (NIST 800-53 r5) AI
SC-13 requires selection and implementation of specific cryptography types, directly stopping use of broken algorithms.
Authenticator management requires generation and distribution of values that cannot be derived from observable state.
Cryptographic key establishment mandates use of unpredictable, non-observable values for keys and nonces.
Session authenticity protection requires session identifiers or tokens that resist prediction from network or timing observations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines can enforce use of cryptographically secure RNG sources and disable predictable state-based mechanisms.
Secure SDLC practices directly require cryptographically secure random values instead of observable state such as time or PID.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.31 only requires identifying, reviewing and considering legal/regulatory/contractual requirements (including crypto restrictions); it does not itself stop use of a broken algorithm or block its exploitation
A.5.6 only promotes membership in groups to receive early warnings, advisories, and specialist advice about vulnerabilities (including risky crypto); it does not stop exploitation of an already-present broken algorithm, which requires other controls (e.g. A.8.24) to act.
Cryptographic controls replace predictable values with high-entropy, non-guessable material.
SDLC requirements encourage secure design but do not directly mandate removal of predictable state.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.