CVE-2023-38379
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application.
Risk Assessment
Attackers can gain access to the administrator account, potentially leading to unauthorized management of the device and damage to the infrastructure.
Recommendation
It is recommended to update the oscilloscope firmware to the latest version and implement additional security measures to restrict access to the web interface.
Other vulnerabilities in RIGOL MSO5000 digital oscilloscope
Original NVD description (English source)
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to change the admin password via a zero-length pass0 to the webcontrol changepwd.cgi application, i.e., the entered password only needs to match the first zero characters of the saved password.