Strix
26.1K

CVE-2023-37755

CRITICALCVSS 9.8/10EPSS 1.09%

Last modified

CVE-2023-37755 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).. EPSS estimates a 1.09% chance of exploitation in the next 30 days.

Description

i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.09%

61.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
I-DoitI-Doit<= 25

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2023-37755?
i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning or prompt to ask users to change the default password and account name. Unauthenticated attackers can exploit this vulnerability to obtain Administrator privileges, resulting in them being able to perform arbitrary system operations or cause a Denial of Service (DoS).
How severe is CVE-2023-37755?
CVE-2023-37755 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.09% probability of exploitation in the next 30 days.
How do I fix CVE-2023-37755?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-37755?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST