CVE-2023-47674 (GCVE-0-2023-47674)
Vulnerability from cvelistv5 – Published: 2023-11-16 07:28 – Updated: 2025-06-11 14:12
VLAI
EPSS
VEX
Summary
Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-11 14:11 UTC
CWE
- Missing authentication for critical function
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
Impacted products
11 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| First Co., Ltd. | CFR-904E, CFR-908E, CFR-916E |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | CFR-4EHD, CFR-8EHD, CFR-16EHD |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | CFR-4EHA, CFR-8EHA, CFR-16EHA |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | CFR-4EAAM, CFR-4EABC |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | CFR-4EAA, CFR-8EAA, CFR-16EAA |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | CFR-4EAB, CFR-8EAB, CFR-16EAB |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | CFR-1004EA, CFR-1008EA, CFR-1016EA |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | MD-404HD, MD-808HD |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | MD-404HA, MD-808HA |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | MD-404AA, MD-808AA |
Affected:
firmware all versions
|
guessed | |
| First Co., Ltd. | MD-404AB, MD-808AB |
Affected:
firmware all versions
|
guessed |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:16:43.197Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-47674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-11T14:11:19.703443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-11T14:12:04.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CFR-904E, CFR-908E, CFR-916E",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EHD, CFR-8EHD, CFR-16EHD",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EHA, CFR-8EHA, CFR-16EHA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAAM, CFR-4EABC",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAA, CFR-8EAA, CFR-16EAA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAB, CFR-8EAB, CFR-16EAB",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-1004EA, CFR-1008EA, CFR-1016EA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404HD, MD-808HD",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404HA, MD-808HA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404AA, MD-808AA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404AB, MD-808AB",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authentication for critical function vulnerability in First Corporation\u0027s DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing authentication for critical function",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-16T07:28:38.522Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-47674",
"datePublished": "2023-11-16T07:28:38.522Z",
"dateReserved": "2023-11-15T01:42:54.432Z",
"dateUpdated": "2025-06-11T14:12:04.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2023-47674",
"date": "2026-09-18",
"epss": "0.01264",
"percentile": "0.68371"
},
"fkie_nvd": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-1004ea_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5825474F-41ED-4C9B-9066-09444B5272E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-1004ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DC008F3-9362-4466-93E3-1423E3A8F7CB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-1008ea_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CCBA5D3-2942-4AC4-8891-C2539A8221A8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-1008ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "96A5AE65-A0E9-47A6-8B4A-A965F206D945",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-1016ea_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "109B6B6F-0E58-4EFC-92F5-D01A6D4F6050",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-1016ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32B6F5E1-19CE-4353-83C4-9E9BAC59F3DF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16eaa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DCA76BA6-DB42-432F-B092-EF525002FE1A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16eaa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DC9F82F-EDF3-4F5D-BA28-8021406B38CE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16eab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4EECDA12-C85D-4938-B464-81871BE6D65C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16eab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3A292B7-C1B6-4A9B-AF2F-665647AD15CC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16eha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FD51F31A-821C-4177-90F9-9F906AB6947B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16eha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3F9E23B6-BF8A-460D-AB8E-715865B60D98",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16ehd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F14C536-5D25-40DB-AD3A-3D680DC125F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16ehd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56C93D63-A331-4734-B02C-84E31911183D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eaa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89F748BF-5CA0-4EC5-86A5-8BF96BACDF8B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eaa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E70644AD-C793-4E8A-A186-FC3384A9DA09",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eaam_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64F65158-35BE-47F6-9F23-E592E12FBA42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eaam:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6788DE81-98C8-42FA-975E-F22A70CF5328",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D67CDAAD-3B8C-4EF2-83D5-2443389CED60",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E52C63E-3C34-41CA-A12F-A691CC2FE71E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eabc_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "707835D1-2323-4984-9DA3-C46D023A5BE6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eabc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4F437F9-B9AA-48FB-A2B1-D1FC96DE865D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FA935841-396B-42AC-87EE-D5250309D851",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9402CDD-5159-40C7-B341-2F3C01941F72",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4ehd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A4B9ABC7-C742-402E-96F2-5EC398D186A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4ehd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B2C6CA6-9EBC-426D-BDBE-6738164C928E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8eaa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DF3876EE-50A9-48FD-BF86-547ADB0A23DE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8eaa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "726839B1-59D5-4B9A-9696-DB4E18B13948",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8eab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3E00035-C9F2-4A6D-997E-6FFE6C1B1FF8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8eab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94DC7DB8-9B44-4968-90A2-34283047596C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8eha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70A252A5-60BB-464D-9497-B5F288104B0F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8eha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D9CC4970-3AF1-4070-9BD3-C388D2D38359",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8ehd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFAAE-E3AA-444A-92E5-A0F5F6060CC0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8ehd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D002126F-D722-4BD4-A269-08B8F1D40BBE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-904e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C47E288C-360A-4E57-8972-D005A65D8522",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-904e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6ABE81EF-440D-49F6-BAAC-977106E5485C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-908e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CE167139-4702-4D8F-9846-6B8925BEC926",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-908e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A569A78-FAD5-4066-A026-3A8BC8DAED71",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-916e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B510418-43B3-494F-837D-27A3B10ADC3A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-916e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A087B2FC-800B-4CAE-93A3-DF7EC34625D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404aa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "96710570-7241-4799-B37E-FD9F71225479",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404aa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F9AB4E20-9F98-4246-B701-C940BC8A117E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404ab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F1652800-6EB0-4513-BCB5-3B3DD6BDAA96",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404ab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB6D4D91-0519-485C-B7A5-52E869B73589",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404ha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5935347-858F-4D91-8C68-5946F58557B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404ha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DA1EAAD8-FFC4-45A6-8678-C39C347AB7AA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404hd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "37F7F46B-1CF6-4308-86ED-499F769D62D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404hd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "48266165-7A81-4593-BB02-DEE028602AE6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808aa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "130ED09D-97E4-47F1-BB5E-BD50838102DB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808aa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A84CD34A-C75B-4DC6-AE19-8D51D6A38ED8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808ab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8324E0AA-4579-4F67-9881-9FCD166C0B45",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808ab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BDE5F07A-E0D6-4A69-AEB2-5831B70447A0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808ha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4D3CB46-C862-4938-B4C0-7D5706EAF590",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808ha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B020F92-62DA-4D50-965E-7D4F24C95B1F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808hd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2EA778-F4B2-42EF-A13A-BA3679E053F8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808hd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5DA0B38E-E2FE-45EF-9D4E-89E9BC346A09",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authentication for critical function vulnerability in First Corporation\u0027s DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround."
},
{
"lang": "es",
"value": "La falta de autenticaci\u00f3n para una vulnerabilidad de funci\u00f3n cr\u00edtica en los DVR de First Corporation permite que un atacante remoto no autenticado reescriba u obtenga la informaci\u00f3n de configuraci\u00f3n del dispositivo afectado. Tenga en cuenta que las actualizaciones se proporcionan solo para los modelos m\u00e1s recientes de CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB y MD-808AB. En cuanto a los dem\u00e1s productos, aplique workaround."
}
],
"id": "CVE-2023-47674",
"lastModified": "2024-11-21T08:30:39.267",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-11-16T08:15:33.147",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "CFR-904E, CFR-908E, CFR-916E",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EHD, CFR-8EHD, CFR-16EHD",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EHA, CFR-8EHA, CFR-16EHA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAAM, CFR-4EABC",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAA, CFR-8EAA, CFR-16EAA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAB, CFR-8EAB, CFR-16EAB",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-1004EA, CFR-1008EA, CFR-1016EA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404HD, MD-808HD",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404HA, MD-808HA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404AA, MD-808AA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404AB, MD-808AB",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
}
],
"source": "vultures@jpcert.or.jp"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-1004ea_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5825474F-41ED-4C9B-9066-09444B5272E0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-1004ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DC008F3-9362-4466-93E3-1423E3A8F7CB",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-1008ea_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "9CCBA5D3-2942-4AC4-8891-C2539A8221A8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-1008ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "96A5AE65-A0E9-47A6-8B4A-A965F206D945",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-1016ea_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "109B6B6F-0E58-4EFC-92F5-D01A6D4F6050",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-1016ea:-:*:*:*:*:*:*:*",
"matchCriteriaId": "32B6F5E1-19CE-4353-83C4-9E9BAC59F3DF",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16eaa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DCA76BA6-DB42-432F-B092-EF525002FE1A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16eaa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6DC9F82F-EDF3-4F5D-BA28-8021406B38CE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16eab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4EECDA12-C85D-4938-B464-81871BE6D65C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16eab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3A292B7-C1B6-4A9B-AF2F-665647AD15CC",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16eha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FD51F31A-821C-4177-90F9-9F906AB6947B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16eha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3F9E23B6-BF8A-460D-AB8E-715865B60D98",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-16ehd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F14C536-5D25-40DB-AD3A-3D680DC125F3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-16ehd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "56C93D63-A331-4734-B02C-84E31911183D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eaa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "89F748BF-5CA0-4EC5-86A5-8BF96BACDF8B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eaa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E70644AD-C793-4E8A-A186-FC3384A9DA09",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eaam_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "64F65158-35BE-47F6-9F23-E592E12FBA42",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eaam:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6788DE81-98C8-42FA-975E-F22A70CF5328",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D67CDAAD-3B8C-4EF2-83D5-2443389CED60",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "7E52C63E-3C34-41CA-A12F-A691CC2FE71E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eabc_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "707835D1-2323-4984-9DA3-C46D023A5BE6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eabc:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4F437F9-B9AA-48FB-A2B1-D1FC96DE865D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4eha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FA935841-396B-42AC-87EE-D5250309D851",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4eha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E9402CDD-5159-40C7-B341-2F3C01941F72",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-4ehd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A4B9ABC7-C742-402E-96F2-5EC398D186A6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-4ehd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B2C6CA6-9EBC-426D-BDBE-6738164C928E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8eaa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DF3876EE-50A9-48FD-BF86-547ADB0A23DE",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8eaa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "726839B1-59D5-4B9A-9696-DB4E18B13948",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8eab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F3E00035-C9F2-4A6D-997E-6FFE6C1B1FF8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8eab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "94DC7DB8-9B44-4968-90A2-34283047596C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8eha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "70A252A5-60BB-464D-9497-B5F288104B0F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8eha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D9CC4970-3AF1-4070-9BD3-C388D2D38359",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-8ehd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C10AFAAE-E3AA-444A-92E5-A0F5F6060CC0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-8ehd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D002126F-D722-4BD4-A269-08B8F1D40BBE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-904e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "C47E288C-360A-4E57-8972-D005A65D8522",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-904e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6ABE81EF-440D-49F6-BAAC-977106E5485C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-908e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CE167139-4702-4D8F-9846-6B8925BEC926",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-908e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5A569A78-FAD5-4066-A026-3A8BC8DAED71",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:cfr-916e_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B510418-43B3-494F-837D-27A3B10ADC3A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:cfr-916e:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A087B2FC-800B-4CAE-93A3-DF7EC34625D4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404aa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "96710570-7241-4799-B37E-FD9F71225479",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404aa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F9AB4E20-9F98-4246-B701-C940BC8A117E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404ab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F1652800-6EB0-4513-BCB5-3B3DD6BDAA96",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404ab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB6D4D91-0519-485C-B7A5-52E869B73589",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404ha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5935347-858F-4D91-8C68-5946F58557B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404ha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DA1EAAD8-FFC4-45A6-8678-C39C347AB7AA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-404hd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "37F7F46B-1CF6-4308-86ED-499F769D62D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-404hd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "48266165-7A81-4593-BB02-DEE028602AE6",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808aa_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "130ED09D-97E4-47F1-BB5E-BD50838102DB",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808aa:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A84CD34A-C75B-4DC6-AE19-8D51D6A38ED8",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808ab_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8324E0AA-4579-4F67-9881-9FCD166C0B45",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808ab:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BDE5F07A-E0D6-4A69-AEB2-5831B70447A0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808ha_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E4D3CB46-C862-4938-B4C0-7D5706EAF590",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808ha:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3B020F92-62DA-4D50-965E-7D4F24C95B1F",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:c-first:md-808hd_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "6D2EA778-F4B2-42EF-A13A-BA3679E053F8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:c-first:md-808hd:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5DA0B38E-E2FE-45EF-9D4E-89E9BC346A09",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing authentication for critical function vulnerability in First Corporation\u0027s DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround."
},
{
"lang": "es",
"value": "La falta de autenticaci\u00f3n para una vulnerabilidad de funci\u00f3n cr\u00edtica en los DVR de First Corporation permite que un atacante remoto no autenticado reescriba u obtenga la informaci\u00f3n de configuraci\u00f3n del dispositivo afectado. Tenga en cuenta que las actualizaciones se proporcionan solo para los modelos m\u00e1s recientes de CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB y MD-808AB. En cuanto a los dem\u00e1s productos, aplique workaround."
}
],
"id": "CVE-2023-47674",
"lastModified": "2026-06-17T06:33:06.057",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-47674",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-11T14:11:19.703443Z",
"version": "2.0.3"
}
}
]
},
"published": "2023-11-16T08:15:33.147",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-306"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"current_release_date": "2025-05-29T00:19:26+00:00",
"cve": "CVE-2023-47674",
"id": "CVE-2023-47674",
"initial_release_date": "2023-01-01T00:00:00+00:00",
"product_status:known_not_affected": "1",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "CVE-2023-47674",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-47674.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T21:16:43.197Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2023-47674",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-11T14:11:19.703443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-11T14:11:53.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "CFR-904E, CFR-908E, CFR-916E",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EHD, CFR-8EHD, CFR-16EHD",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EHA, CFR-8EHA, CFR-16EHA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAAM, CFR-4EABC",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAA, CFR-8EAA, CFR-16EAA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-4EAB, CFR-8EAB, CFR-16EAB",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "CFR-1004EA, CFR-1008EA, CFR-1016EA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404HD, MD-808HD",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404HA, MD-808HA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404AA, MD-808AA",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
},
{
"product": "MD-404AB, MD-808AB",
"vendor": "First Co., Ltd.",
"versions": [
{
"status": "affected",
"version": "firmware all versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Missing authentication for critical function vulnerability in First Corporation\u0027s DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Missing authentication for critical function",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-11-16T07:28:38.522Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://www.c-first.co.jp/information/ddososhirase/"
},
{
"url": "https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU99077347/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-47674",
"datePublished": "2023-11-16T07:28:38.522Z",
"dateReserved": "2023-11-15T01:42:54.432Z",
"dateUpdated": "2025-06-11T14:12:04.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…