CVE-2023-22906 - Vulnerability Details - OpenCVE

ReportizFlow

Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Heroelectronix	Qubo Hcd01 Qubo Hcd01 Firmware Qubo Hcd02 Qubo Hcd02 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:heroelectronix:qubo_hcd01_firmware:1.38_20220125:*:*:*:*:*:*:*

cpe:2.3:h:heroelectronix:qubo_hcd01:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:heroelectronix:qubo_hcd02_firmware:1.38_20220125:*:*:*:*:*:*:*

cpe:2.3:h:heroelectronix:qubo_hcd02:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/nonamecoder/CVE-2023-22906
https://twitter.com/ayyappan162010/status/1610764707753000960

History

Mon, 25 Nov 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-07-03T00:00:00

Updated: 2024-11-25T18:15:29.925Z

Reserved: 2023-01-10T00:00:00

Link: CVE-2023-22906

Vulnrichment

Updated: 2024-08-02T10:20:31.392Z

NVD

Status : Modified

Published: 2023-07-04T00:15:09.407

Modified: 2024-11-21T07:45:37.417

Link: CVE-2023-22906

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:heroelectronix:qubo_hcd01_firmware:1.38_20220125:*:*:*:*:*:*:*", "matchCriteriaId": "431AD958-87CC-4D33-9C77-ED0DC147CDD6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:heroelectronix:qubo_hcd01:-:*:*:*:*:*:*:*", "matchCriteriaId": "3B14D424-E7F6-4F43-85D7-44BA8245686A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:heroelectronix:qubo_hcd02_firmware:1.38_20220125:*:*:*:*:*:*:*", "matchCriteriaId": "855BB29B-A00F-414D-8C9E-FC528DA3C3E0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:heroelectronix:qubo_hcd02:-:*:*:*:*:*:*:*", "matchCriteriaId": "4721C482-4FEB-415E-976C-1D484EE48041", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Hero Qubo HCD01_02_V1.38_20220125 devices allow TELNET access with root privileges by default, without a password."}], "id": "CVE-2023-22906", "lastModified": "2024-11-21T07:45:37.417", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-07-04T00:15:09.407", "references": [{"source": "[email protected]", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://github.com/nonamecoder/CVE-2023-22906"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://twitter.com/ayyappan162010/status/1610764707753000960"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "url": "https://github.com/nonamecoder/CVE-2023-22906"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://twitter.com/ayyappan162010/status/1610764707753000960"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "[email protected]", "type": "Primary"}]}