CVE-2023-5222

A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-240364. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-259

• https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_HardcodedPassword.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.240364Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.240364Permissions Required, Third Party Advisory, VDB Entry
• https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_HardcodedPassword.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.240364Permissions Required, Third Party Advisory, VDB Entry
• https://vuldb.com/?id.240364Permissions Required, Third Party Advisory, VDB Entry

Published

Sep 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52214Missing Authorization vulnerability in voidCoders Void Conta…8.8
• CVE-2023-52215Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-52216Cross-Site Request Forgery (CSRF) vulnerability in Yevhen Ko…8.8
• CVE-2023-52217Missing Authorization vulnerability in weDevs WooCommerce Co…6.3
• CVE-2023-52218Deserialization of Untrusted Data vulnerability in Anton Bon…9.8
• CVE-2023-52219Deserialization of Untrusted Data vulnerability in Gecka Gec…8.8
• CVE-2023-52220Missing Authorization vulnerability in MonsterInsights Googl…4.3
• CVE-2023-52221Unrestricted Upload of File with Dangerous Type vulnerabilit…9.8
• CVE-2023-52222Cross-Site Request Forgery (CSRF) vulnerability in Automatti…8.8
• CVE-2023-52223Cross-Site Request Forgery (CSRF) vulnerability in MailerLit…8.8
• CVE-2023-52224Missing Authorization vulnerability in Revolut Revolut Gatew…4.3
• CVE-2023-52225Deserialization of Untrusted Data vulnerability in Tagbox Ta…9.8