CVE-2023-49261
Info Disclosure in Hongdian H8951-4G-Esp Firmware ≤ 2310271149
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-49261 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Hongdian H8951-4G-Esp Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53263
- 🇵🇱 CERT-PL: cert.pl
- 🇵🇱 CERT-PL: cert.pl
Vulnerability Data
The "tokenKey" value used in user authorization is visible in the HTML source of the login page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V14.2.3
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized actors from obtaining sensitive information.
Directly enforces policy-based information flow rules that block transmission of sensitive data to unauthorized actors.
Protection of information at rest prevents unauthorized exposure of stored sensitive data.
Transmission confidentiality mechanisms stop exposure of sensitive data on the wire.
Least privilege reduces the set of actors who can reach sensitive information.
Requires validation of outbound information to ensure sensitive content is not disclosed in responses or messages.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Monitoring runtime data flows and outputs can detect sensitive data being transmitted.
Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.
Protecting data-in-use includes removing confidential values before they are processed or sent.
Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing classification and other controls; per the owner's explicit rule on labelling and similar dependency-style clauses, this does not itself prevent exposure (CWE-200) unless access/DLP/etc. act on it.
Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.
Classification identifies sensitive data so it is not inadvertently transmitted.
Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.