« Volver al listado

CVE-2023-49256

Estado: ModificadaAlta (7.5)—

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hongdian — H8951-4g-esp Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-49256",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-49256",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-01-12T20:19:27.107711Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cvd@cert.pl",
      "affectedData": [
        {
          "vendor": "Hongdian",
          "product": "H8951-4G-ESP",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2310271149",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-01-12T15:15:09.160",
  "references": [
    {
      "url": "https://cert.pl/en/posts/2024/01/CVE-2023-49253/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cvd@cert.pl"
    },
    {
      "url": "https://cert.pl/posts/2024/01/CVE-2023-49253/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cvd@cert.pl"
    },
    {
      "url": "https://cert.pl/en/posts/2024/01/CVE-2023-49253/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://cert.pl/posts/2024/01/CVE-2023-49253/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cvd@cert.pl",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key."
    },
    {
      "lang": "es",
      "value": "Es posible descargar la copia de seguridad de la configuración sin autorización y descifrar las contraseñas incluidas utilizando una clave estática codificada."
    }
  ],
  "lastModified": "2026-06-17T06:35:42.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:hongdian:h8951-4g-esp_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4391599E-AC50-4409-B8DE-D86CD4EACA35",
              "versionEndExcluding": "2310271149"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:hongdian:h8951-4g-esp:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3B44C0C6-3995-43DB-9B49-78110E5E7A43"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cvd@cert.pl"
}