CVE-2023-38585
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker...
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
- Record
CVE-2023-38585- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
- Record
CVE-2023-38585- Updated
- 2026-11-02
EUVDEUVD-2023-42384
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
- Record
EUVD-2023-42384- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j3px-wrmc-2h8r
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker...
Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
- Record
GHSA-j3px-wrmc-2h8r- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- cbc co.,ltd. dr-16f, dr-8f, dr-4f, dr-16h, dr-8h, dr-4h, dr-4m41 series
- cbc co.,ltd. nr4h, nr8h, nr16h series
- cbc co.,ltd. dr-16m, dr-8m, dr-4m51 series
- cbc co.,ltd. nr-4f, nr-8f, nr-16f series
- cbc co.,ltd. nr-4m, nr-8m, nr-16m series
- cbc dr-16f42a firmware
- cbc dr-16f45at firmware
- cbc dr-16h firmware
- cbc dr-16m52-av firmware
- cbc dr-16m52 firmware
- cbc dr-4fx1 firmware
- cbc dr-4h firmware
Show 16 moreShow less
- cbc dr-4m51-av firmware
- cbc dr-8f42a firmware
- cbc dr-8f45at firmware
- cbc dr-8h firmware
- cbc dr-8m52-av firmware
- cbc drh8-4m41-a firmware
- cbc nr-16f82-16p firmware
- cbc nr-16f85-8pra firmware
- cbc nr-16m firmware
- cbc nr-4f firmware
- cbc nr-8f firmware
- cbc nr16h firmware
- cbc nr4h firmware
- cbc nr8-4m71 firmware
- cbc nr8-8m72 firmware
- cbc nr8h firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38585 is a high vulnerability (CVSS 8.8) in Cbc Co.,ltd. Dr-16f, Dr-8f, Dr-4f, Dr-16h, Dr-8h, Dr-4h, Dr-4m41 Series, published August 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. No source names a fixed version.