CVE-2023-2645

A vulnerability, which was classified as critical, was found in USR USR-G806 1.0.41. Affected is an unknown function of the component Web Management Page. The manipulation of the argument username/password with the input root leads to use of hard-coded password. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-228774 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-259

• https://github.com/wswokao/testrouter/blob/main/README.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.228774Third Party Advisory
• https://vuldb.com/?id.228774Third Party Advisory
• https://github.com/wswokao/testrouter/blob/main/README.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.228774Third Party Advisory
• https://vuldb.com/?id.228774Third Party Advisory

Published

May 11, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26443Full-text autocomplete search allows user-provided SQL synta…9.8
• CVE-2023-26445Frontend themes are defined by user-controllable jslob setti…5.4
• CVE-2023-26446The users clientID at "application passwords" was not saniti…5.4
• CVE-2023-26447The "upsell" widget for the portal allows to specify a produ…5.4
• CVE-2023-26448Custom log-in and log-out locations are used-defined as jslo…5.4
• CVE-2023-26449The "OX Chat" web service did not specify a media-type when …5.4
• CVE-2023-26450The "OX Count" web service did not specify a media-type when…5.4
• CVE-2023-26451Functions with insufficient randomness were used to generate…7.5
• CVE-2023-26452Requests to cache an image and return its metadata could be …8.8
• CVE-2023-26453Requests to cache an image could be abused to include SQL qu…8.8
• CVE-2023-26454Requests to fetch image metadata could be abused to include …8.8
• CVE-2023-26455RMI was not requiring authentication when calling ChronosRMI…7.8