CVE-2023-47674

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-16 · updated 2026-06-17
Weakness: CWE-306

Description

Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite or obtain the configuration information of the affected device. Note that updates are provided only for Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, and MD-808AB. As for the other products, apply the workaround.

Affected products

C-First Cfr-1004Ea Firmware: all versions
C-First Cfr-1008Ea Firmware: all versions
C-First Cfr-1016Ea Firmware: all versions
C-First Cfr-16Eaa Firmware: all versions
C-First Cfr-16Eab Firmware: all versions
C-First Cfr-16Eha Firmware: all versions
C-First Cfr-16Ehd Firmware: all versions
C-First Cfr-4Eaa Firmware: all versions
C-First Cfr-4Eaam Firmware: all versions
C-First Cfr-4Eab Firmware: all versions
C-First Cfr-4Eabc Firmware: all versions
C-First Cfr-4Eha Firmware: all versions
C-First Cfr-4Ehd Firmware: all versions
C-First Cfr-8Eaa Firmware: all versions
C-First Cfr-8Eab Firmware: all versions
C-First Cfr-8Eha Firmware: all versions
C-First Cfr-8Ehd Firmware: all versions
C-First Cfr-904E Firmware: all versions
C-First Cfr-908E Firmware: all versions
C-First Cfr-916E Firmware: all versions
C-First Md-404Aa Firmware: all versions
C-First Md-404Ab Firmware: all versions
C-First Md-404Ha Firmware: all versions
C-First Md-404Hd Firmware: all versions
C-First Md-808Aa Firmware: all versions
C-First Md-808Ab Firmware: all versions
C-First Md-808Ha Firmware: all versions
C-First Md-808Hd Firmware: all versions

References

Get alerted when CVE-2023-47674 or the next vulnerability affects your stack