CVE-2023-27573

Katalog CVE

CVSS 9.8 · Critical EPSS 0,50%

Kerentanan Use of Default Credentials pada netboxlabs netbox-docker. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1392: Use of Default Credentials
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/netbox-community/netbox-docker/pull/959 issue tracking · patch
• https://github.com/netbox-community/netbox-docker/issues/953 exploit · issue tracking
• https://github.com/netbox-community/netbox-docker/releases/tag/2.5.0 release notes