CVE-2023-23324
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Hardcoded credentials for the Administrator account were discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80.
Risk Assessment
An attacker can exploit these credentials to gain unauthorized access to the device, potentially leading to control over the lighting system and further network attacks.
Recommendation
Immediately update the firmware to the latest version that removes hardcoded credentials and change the default administrator password.
Other vulnerabilities in Zumtobel Netlink CCD Onboard
See all- CVE-2023-23325Critical
A command injection vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80 via the NetHostname parameter. An attacker can remotely execute arbitrary system commands.
- CVE-2023-24294High
A buffer overflow vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware version 3.80 in the NetlinkWeb::Information::SetDeviceIdentification component. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.
Original NVD description (English source)
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account.