{"id":"CVE-2023-47674","aliases":["EUVD-2023-51773","GHSA-h9h6-5vxm-9xx3"],"status":"published","title":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a...","description":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01264,"percentile":0.69949,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2023-11-16T07:28:38Z","modified":"2026-06-17T06:33:06Z","products":[{"vendor":"c-first","product":"cfr-1004ea_firmware"},{"vendor":"c-first","product":"cfr-1008ea_firmware"},{"vendor":"c-first","product":"cfr-1016ea_firmware"},{"vendor":"c-first","product":"cfr-16eaa_firmware"},{"vendor":"c-first","product":"cfr-16eab_firmware"},{"vendor":"c-first","product":"cfr-16eha_firmware"},{"vendor":"c-first","product":"cfr-16ehd_firmware"},{"vendor":"c-first","product":"cfr-4eaa_firmware"},{"vendor":"c-first","product":"cfr-4eaam_firmware"},{"vendor":"c-first","product":"cfr-4eab_firmware"},{"vendor":"c-first","product":"cfr-4eabc_firmware"},{"vendor":"c-first","product":"cfr-4eha_firmware"},{"vendor":"c-first","product":"cfr-4ehd_firmware"},{"vendor":"c-first","product":"cfr-8eaa_firmware"},{"vendor":"c-first","product":"cfr-8eab_firmware"},{"vendor":"c-first","product":"cfr-8eha_firmware"},{"vendor":"c-first","product":"cfr-8ehd_firmware"},{"vendor":"c-first","product":"cfr-904e_firmware"},{"vendor":"c-first","product":"cfr-908e_firmware"},{"vendor":"c-first","product":"cfr-916e_firmware"},{"vendor":"c-first","product":"md-404aa_firmware"},{"vendor":"c-first","product":"md-404ab_firmware"},{"vendor":"c-first","product":"md-404ha_firmware"},{"vendor":"c-first","product":"md-404hd_firmware"},{"vendor":"c-first","product":"md-808aa_firmware"},{"vendor":"c-first","product":"md-808ab_firmware"},{"vendor":"c-first","product":"md-808ha_firmware"},{"vendor":"c-first","product":"md-808hd_firmware"},{"vendor":"first co., ltd.","product":"cfr-1004ea, cfr-1008ea, cfr-1016ea"},{"vendor":"first co., ltd.","product":"cfr-4eaa, cfr-8eaa, cfr-16eaa"},{"vendor":"first co., ltd.","product":"cfr-4eaam, cfr-4eabc"},{"vendor":"first co., ltd.","product":"cfr-4eab, cfr-8eab, cfr-16eab"},{"vendor":"first co., ltd.","product":"cfr-4eha, cfr-8eha, cfr-16eha"},{"vendor":"first co., ltd.","product":"cfr-4ehd, cfr-8ehd, cfr-16ehd"},{"vendor":"first co., ltd.","product":"cfr-904e, cfr-908e, cfr-916e"},{"vendor":"first co., ltd.","product":"md-404aa, md-808aa"},{"vendor":"first co., ltd.","product":"md-404ab, md-808ab"},{"vendor":"first co., ltd.","product":"md-404ha, md-808ha"},{"vendor":"first co., ltd.","product":"md-404hd, md-808hd"}],"references":[{"url":"https://www.c-first.co.jp/information/ddososhirase/","tags":["x_transferred","Vendor Advisory"]},{"url":"https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf","tags":["x_transferred","Vendor Advisory"]},{"url":"https://jvn.jp/en/vu/JVNVU99077347/","tags":["x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47674"},{"url":"https://jvn.jp/en/vu/JVNVU99077347"},{"url":"https://www.c-first.co.jp/information/ddososhirase"},{"url":"https://github.com/advisories/GHSA-h9h6-5vxm-9xx3"}],"sources":{"cve":[{"id":"CVE-2023-47674","description":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T07:28:38.522Z","modified":"2025-06-11T14:12:04.23Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:35:14.298866Z"}],"euvd":[{"id":"EUVD-2023-51773","description":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T07:28:38Z","modified":"2025-06-11T14:12:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:26.351797Z"}],"ghsa":[{"id":"GHSA-h9h6-5vxm-9xx3","title":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a...","description":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T09:30:24Z","modified":"2025-06-11T15:31:29Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:02:41.633611Z"}],"nvd":[{"id":"CVE-2023-47674","description":"Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.","status":"published","published":"2023-11-16T08:15:33.147Z","modified":"2026-06-17T06:33:06.057Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:08:47.966245Z"}]}}