{"id":"CVE-2023-47213","aliases":["EUVD-2023-51345","GHSA-hchc-m7jw-6mhm"],"status":"published","title":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated...","description":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01091,"percentile":0.65833,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2023-11-16T07:29:28Z","modified":"2026-06-17T06:32:22Z","products":[{"vendor":"c-first","product":"cfr-1004ea_firmware"},{"vendor":"c-first","product":"cfr-1008ea_firmware"},{"vendor":"c-first","product":"cfr-1016ea_firmware"},{"vendor":"c-first","product":"cfr-16eaa_firmware"},{"vendor":"c-first","product":"cfr-16eab_firmware"},{"vendor":"c-first","product":"cfr-16eha_firmware"},{"vendor":"c-first","product":"cfr-16ehd_firmware"},{"vendor":"c-first","product":"cfr-4eaa_firmware"},{"vendor":"c-first","product":"cfr-4eaam_firmware"},{"vendor":"c-first","product":"cfr-4eab_firmware"},{"vendor":"c-first","product":"cfr-4eabc_firmware"},{"vendor":"c-first","product":"cfr-4eha_firmware"},{"vendor":"c-first","product":"cfr-4ehd_firmware"},{"vendor":"c-first","product":"cfr-8eaa_firmware"},{"vendor":"c-first","product":"cfr-8eab_firmware"},{"vendor":"c-first","product":"cfr-8eha_firmware"},{"vendor":"c-first","product":"cfr-8ehd_firmware"},{"vendor":"c-first","product":"cfr-904e_firmware"},{"vendor":"c-first","product":"cfr-908e_firmware"},{"vendor":"c-first","product":"cfr-916e_firmware"},{"vendor":"c-first","product":"md-404aa_firmware"},{"vendor":"c-first","product":"md-404ab_firmware"},{"vendor":"c-first","product":"md-404ha_firmware"},{"vendor":"c-first","product":"md-404hd_firmware"},{"vendor":"c-first","product":"md-808aa_firmware"},{"vendor":"c-first","product":"md-808ab_firmware"},{"vendor":"c-first","product":"md-808ha_firmware"},{"vendor":"c-first","product":"md-808hd_firmware"},{"vendor":"first co., ltd.","product":"cfr-1004ea, cfr-1008ea, cfr-1016ea"},{"vendor":"first co., ltd.","product":"cfr-4eaa, cfr-8eaa, cfr-16eaa"},{"vendor":"first co., ltd.","product":"cfr-4eaam, cfr-4eabc"},{"vendor":"first co., ltd.","product":"cfr-4eab, cfr-8eab, cfr-16eab"},{"vendor":"first co., ltd.","product":"cfr-4eha, cfr-8eha, cfr-16eha"},{"vendor":"first co., ltd.","product":"cfr-4ehd, cfr-8ehd, cfr-16ehd"},{"vendor":"first co., ltd.","product":"cfr-904e, cfr-908e, cfr-916e"},{"vendor":"first co., ltd.","product":"md-404aa, md-808aa"},{"vendor":"first co., ltd.","product":"md-404ab, md-808ab"},{"vendor":"first co., ltd.","product":"md-404ha, md-808ha"},{"vendor":"first co., ltd.","product":"md-404hd, md-808hd"}],"references":[{"url":"https://www.c-first.co.jp/information/ddososhirase/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://jvn.jp/en/vu/JVNVU99077347/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47213"},{"url":"https://jvn.jp/en/vu/JVNVU99077347"},{"url":"https://www.c-first.co.jp/information/ddososhirase"},{"url":"https://github.com/advisories/GHSA-hchc-m7jw-6mhm"}],"sources":{"cve":[{"id":"CVE-2023-47213","description":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T07:29:28.376Z","modified":"2024-10-21T14:27:58.805Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:35:14.298866Z"}],"euvd":[{"id":"EUVD-2023-51345","description":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T07:29:28Z","modified":"2024-10-21T14:27:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:27:32.038051Z"}],"ghsa":[{"id":"GHSA-hchc-m7jw-6mhm","title":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated...","description":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T09:30:24Z","modified":"2024-10-21T18:31:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:58:33.735007Z"}],"nvd":[{"id":"CVE-2023-47213","description":"First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T08:15:32.84Z","modified":"2026-06-17T06:32:22.553Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:08:47.966245Z"}]}}