github.com
https://github.com/leekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-below/blob/main/README.md CVE-2023-37755
CRITICAL
Record summary
CVE-2023-37755 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC.
Description
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).
Description source: CVE List
Exploitation context
Available material
- Repository PoCs
- 1
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 26, 2024 · Source: CVE List
Proofs of concept
1Repository PoCs
GitHubleekenghwa/CVE-2023-37755---Hardcoded-Admin-Credential-in-i-doit-Pro-25-and-belowRepository PoCby leekenghwaStars: 0Not analyzed1 file
References
6medium.com
https://medium.com/%40ray.999/d7a54030e055 medium.com
https://medium.com/%40ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055 medium.com
https://medium.com/@ray.999/d7a54030e055 medium.com
https://medium.com/@ray.999/i-doit-v25-and-below-incorrect-access-control-issue-cve-2023-37755-d7a54030e055 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-37755