SB2023112707 - Multiple vulnerabilities in First Corporation DVRs

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use of Hard-coded Password (CVE-ID: CVE-2023-47213)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to use a hard-coded password. A remote attacker can rewrite or obtain the configuration information of the target device.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2023-47674)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to missing authentication for critical functionn. A remote attacker can rewrite or obtain the configuration information of the target device.

Remediation

Install update from vendor's website.

References

• https://www.c-first.co.jp/information/ddososhirase/
• https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf
• https://jvn.jp/en/vu/JVNVU99077347/