Hard-coded Credentials Vulnerability in SS1 and Rakuraku PC Cloud Agent from Dos Co.
CVE-2023-22344

9.8CRITICAL

Key Information:

Vendor: Dos Co., Ltd.
Status: Ss1 And Rakuraku Pc Cloud
Vendor: CVE Published:; 6 March 2023

🔔 Create Dos Co., Ltd. Vulnerability Alert

What is CVE-2023-22344?

The vulnerability in SS1 and Rakuraku PC Cloud Agent stems from the use of hard-coded credentials, enabling remote attackers to exploit the debug tool’s password. By leveraging this weakness alongside vulnerabilities CVE-2023-22335 and CVE-2023-22336, attackers could execute arbitrary code with SYSTEM privileges by deploying specially crafted scripts, posing a significant risk to the integrity and security of the affected systems.

Affected Version(s)

SS1 and Rakuraku PC Cloud SS1 Ver.13.0.0.40 and earlier, and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier

References

https://www.dos-osaka.co.jp/news/2023/03/230301.html

https://jvn.jp/en/jp/JVN57224029/

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 6, 2023
Vulnerability Reserved
Dec 28, 2022

CVE-2023-22344 Data

JSON