CVE-2023-37755

{"id": "CVE-2023-37755", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-09-14T20:15:10.477", "references": [{"url": "https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/blob/main/README.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://medium.com/%40ray.999/d7a54030e055", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS)."}, {"lang": "es", "value": "i-doit pro 25 e inferiores e I-doit open 25 e inferiores est\u00e1n configurados con credenciales de administrador predeterminadas inseguras, y no hay ninguna advertencia ni mensaje para pedir a los usuarios que cambien la contrase\u00f1a y el nombre de cuenta predeterminados. Los atacantes no autenticados pueden aprovechar esta vulnerabilidad para obtener privilegios de administrador, lo que les permite realizar operaciones arbitrarias del sistema o provocar una denegaci\u00f3n de servicio (DoS)."}], "lastModified": "2023-11-07T04:17:04.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:i-doit:i-doit:*:*:*:*:open:*:*:*", "vulnerable": true, "matchCriteriaId": "373CFC60-0098-4FD1-AFA0-1D8FDCEF486D", "versionEndIncluding": "25"}, {"criteria": "cpe:2.3:a:i-doit:i-doit:*:*:*:*:pro:*:*:*", "vulnerable": true, "matchCriteriaId": "29ACB05B-F001-4365-B125-526E4D4554A6", "versionEndIncluding": "25"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}