Advantech R-SeeNet Use of Hard-coded Credentials
CVE-2023-2611

9.8CRITICAL

Key Information:

Vendor
Advantech
Status
R-seenet
Vendor
CVE Published:
22 June 2023

Summary

Advantech R-SeeNet version 2.4.22 includes a hidden root-level user account that is not discernible in the active user list. This account possesses a password that cannot be modified by legitimate users, which poses significant access control issues and makes the system vulnerable to unauthorized access.

Affected Version(s)

R-SeeNet 0 <= 2.4.22

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-1...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Esjay, working with Trend Micro Zero Day Initiative, reported these vulnerabilities to CISA.
.