CVE-2023-39808
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A hardcoded root password was discovered in N.V.K.INTER CO., LTD. (NVK) iBSG v3.5. This allows attackers to log in with root privileges via SSH.
Risk Assessment
The organization is at risk of complete system compromise by an unauthorized user, potentially leading to data theft, malware installation, or service disruption.
Recommendation
Immediately change the default root password to a strong, unique password and update the iBSG software to the latest version once a patch is released by the vendor.
Other vulnerabilities in iBSG
See all- CVE-2023-39809Critical
An OS command injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK). The flaw exists in the system_hostname parameter at /manage/network-basic.php, allowing shell metacharacters to be injected.
- CVE-2023-39807Critical
A SQL injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK) via the a_passwd parameter at /portal/user-register.php. This flaw allows an attacker to manipulate database queries.
Original NVD description (English source)
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privileges via the SSH service. The cleartext password corresponding to the $1$4Tmm01jl$7HRvcW.bz7uGmX9hiQWvR hash was not determined by the vulnerability discoverer.