« Volver al listado

CVE-2023-53983

Estado: ModificadaCrítica (9.3)—

Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Credenciales administrativas débiles en producto expuesto en red (AV:N, PR:N) permiten autenticación no autorizada (T1078.001) y ejecución de comandos remota con control total del sistema (T1059). CWE-798 confirma uso de credenciales por defecto.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementVulnerability ScanningRestrict Web-Based ContentPassword PoliciesNetwork SegmentationMulti-factor Authentication

Tecnologías afectadas (4)

Ateme — Flamingo XL FirmwareAteme — Flamingo XS FirmwareAteme — SoapliveAteme — Soapsystem

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-53983",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-53983",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-02T14:25:34.508723Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Ateme",
          "product": "Anevia Flamingo XL/XS",
          "versions": [
            {
              "status": "affected",
              "version": "3.6.20"
            },
            {
              "status": "affected",
              "version": "3.2.9"
            }
          ]
        },
        {
          "vendor": "Ateme",
          "product": "SoapLive",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.0.3"
            }
          ]
        },
        {
          "vendor": "Ateme",
          "product": "SoapSystem",
          "versions": [
            {
              "status": "affected",
              "version": "1.3.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-30T23:15:48.163",
  "references": [
    {
      "url": "https://cxsecurity.com/issue/WLB-2023060019",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/259059",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://packetstormsecurity.com/files/172875/Anevia-Flamingo-XL-XS-3.6.x-Default-Hardcoded-Credentials.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.ateme.com/",
      "tags": [
        "Product"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/anevia-flamingo-xlxs-default-credentials-authentication-bypass",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5777.php",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2023-5777.php",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms."
    },
    {
      "lang": "es",
      "value": "Anevia Flamingo XL/XS 3.6.20 contiene una vulnerabilidad crítica con credenciales administrativas predeterminadas débiles que pueden ser fácilmente adivinadas. Los atacantes pueden aprovechar estas credenciales codificadas para obtener control total remoto del sistema sin mecanismos de autenticación complejos."
    }
  ],
  "lastModified": "2026-09-24T23:10:00.133",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ateme:flamingo_xl_firmware:3.2.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7DA2A13-C8E0-4E85-9A88-CF8483C245C1"
            },
            {
              "criteria": "cpe:2.3:o:ateme:flamingo_xl_firmware:3.6.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "360CCA47-3823-4C06-926C-B73742878506"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ateme:flamingo_xl:1.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "719E1C7A-4BDB-4E45-9FE6-DE8980C98B34"
            },
            {
              "criteria": "cpe:2.3:h:ateme:flamingo_xl:1.1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "EA45AA11-0B30-461A-A5CC-67808204909B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ateme:flamingo_xs_firmware:3.2.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31A30685-1DFA-4E24-A23B-2C49106C50E7"
            },
            {
              "criteria": "cpe:2.3:o:ateme:flamingo_xs_firmware:3.6.20:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DFE53BF-BF12-4A80-805F-AE5EF0305DD8"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ateme:flamingo_xs:1.0:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "38F53978-9D70-437E-8952-25A3CCEA0692"
            },
            {
              "criteria": "cpe:2.3:h:ateme:flamingo_xs:1.1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3BBACA6C-CAC5-4854-AA79-F47D66357414"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ateme:soaplive:2.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDFC906E-6EDD-4EF1-AF4D-9D1FBC0B0967"
            },
            {
              "criteria": "cpe:2.3:a:ateme:soaplive:2.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E462C8DC-62C5-411B-8ABC-E8C65E41388C"
            },
            {
              "criteria": "cpe:2.3:a:ateme:soapsystem:1.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3A2C190E-DA36-46D4-8F92-239DC150BE63"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}