CVE-2023-38379

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application, i.e., the entered password only needs to match the first zero characters of the saved password.
References
Link Resource
https://news.ycombinator.com/item?id=36745664 Issue Tracking Third Party Advisory
https://tortel.li/post/insecure-scope/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:rigol:mso5000_firmware:00.01.03.00.03:*:*:*:*:*:*:*
cpe:2.3:h:rigol:mso5000:-:*:*:*:*:*:*:*

History

30 Oct 2024, 18:35

Type Values Removed Values Added
CWE CWE-306

26 Jul 2023, 03:28

Type Values Removed Values Added
First Time Rigol mso5000 Firmware
Rigol mso5000
Rigol
References (MISC) https://news.ycombinator.com/item?id=36745664 - (MISC) https://news.ycombinator.com/item?id=36745664 - Issue Tracking, Third Party Advisory
References (MISC) https://tortel.li/post/insecure-scope/ - (MISC) https://tortel.li/post/insecure-scope/ - Exploit, Third Party Advisory
CPE cpe:2.3:o:rigol:mso5000_firmware:00.01.03.00.03:*:*:*:*:*:*:*
cpe:2.3:h:rigol:mso5000:-:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.5
CWE NVD-CWE-noinfo

16 Jul 2023, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-07-16 17:15

Updated : 2024-10-30 18:35


NVD link : CVE-2023-38379

Mitre link : CVE-2023-38379

CVE.ORG link : CVE-2023-38379


JSON object : View

Products Affected

rigol

  • mso5000_firmware
  • mso5000
CWE
NVD-CWE-noinfo CWE-306

Missing Authentication for Critical Function