CVE-2023-38433

HIGHNuclei

fujitsu ip-he950e_firmware Use of Hard-coded Credentials

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-38433 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 17, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 23, 2024 · Source: CVE List

Affected products and versions

Showing 12 of 20
ProductSourceVersion range

IP-90

Browse Fujitsu Limited / IP-90
CVE Listfirmware versions V01L001 to V01L013affected

IP-900D / IP-900ⅡD / IP-920D

Browse Fujitsu Limited / IP-900D / IP-900ⅡD / IP-920D
CVE Listfirmware versions V01L001 to V02L061affected

IP-900E / IP-920E

Browse Fujitsu Limited / IP-900E / IP-920E
CVE Listfirmware versions V01L001 to V02L061affected

IP-9610

Browse Fujitsu Limited / IP-9610
CVE Listfirmware versions V01L001 to V02L007affected

IP-HE900D

Browse Fujitsu Limited / IP-HE900D
CVE Listfirmware versions V01L001 to V01L004affected

IP-HE900E

Browse Fujitsu Limited / IP-HE900E
CVE Listfirmware versions V01L001 to V01L010affected

IP-HE950D

Browse Fujitsu Limited / IP-HE950D
CVE Listfirmware versions V01L001 to V01L053affected

IP-HE950E

Browse Fujitsu Limited / IP-HE950E
CVE Listfirmware versions V01L001 to V01L053affected

ip-90

Browse fujitsu / ip-90

Default status: unknown

CVE ListV01L001 to ≤ V01L013affected

ip-900d_firmware

Browse fujitsu / ip-900d_firmware

Default status: unknown

CVE Listv01l001 to ≤ V02L061affected

ip-900e_firmware

Browse fujitsu / ip-900e_firmware

Default status: unknown

CVE Listv01l001 to ≤ V02L061affected

ip-900iid_firmware

Browse fujitsu / ip-900iid_firmware

Default status: unknown

CVE Listv01l001 to ≤ V02L061affected

Nuclei templates

1
ProjectDiscoveryHIGHFujitsu IP Series - Hardcoded CredentialsCVSS 7.5

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative access to the devices.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the device, potentially resulting in further compromise of the network.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

WeaknessesCWE-798
AuthorsAdnaneKhan
Template tagscve2023cvefujitsuip-seriesvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CPE: cpe:2.3:o:fujitsu:ip-he950e_firmware:*:*:*:*:*:*:*:*
Shodan: "Server: thttpd/2.25b 29dec2003" content-length:1133
Shodan: "server: thttpd/2.25b 29dec2003" content-length:1133
https://www.praetorian.com/blog/fujitsu-ip-series-hard-coded-credentials https://nvd.nist.gov/vuln/detail/CVE-2023-38433 https://www.cisa.gov/news-events/ics-advisories/icsa-23-248-01 https://www.fujitsu.com/global/products/computing/peripheral/video/download https://jvn.jp/en/jp/JVN95727578

Source: ProjectDiscovery

References

3