CVE-2023-2611: Advantech R-SeeNet Use of Hard-coded Credentials

Q: What is the severity of CVE-2023-2611?

The severity of CVE-2023-2611 is critical with a severity value of 9.8.

Q: Which software versions are affected by CVE-2023-2611?

Advantech R-SeeNet versions up to and including 2.4.22 are affected by CVE-2023-2611.

Q: How can I fix CVE-2023-2611?

There is no known fix or patch available for CVE-2023-2611 at the moment. It is recommended to follow the guidance provided by the vendor or product manufacturer.

Q: Where can I find more information about CVE-2023-2611?

You can find more information about CVE-2023-2611 at the following reference URL: https://www.cisa.gov/news-events/ics-advisories/icsa-23-173-02

Published Jun 22, 2023

Updated

Advantech R-SeeNet versions 2.4.22

is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that cannot be changed by users.

Affected Software

2 affected components

Advantech R-SeeNet<=2.4.22

Advantech R-SeeNet: versions 2.4.22 and prior

Remediation

Information

Advantech released R-SeeNet 2.4.23, which fixes both vulnerabilities. All users are recommended to upgrade to this version: https://icr.advantech.cz/products/software/r-seenet https://icr.advantech.cz/products/software/r-seenet

Event History

Jun 22, 2023

CVE Published

via MITRE·04:22 PM

Data Sourced

via MITRE·04:22 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-173-02

Frequently Asked Questions

What is the severity of CVE-2023-2611?

The severity of CVE-2023-2611 is critical with a severity value of 9.8.

What is the vulnerability description of CVE-2023-2611?

Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that cannot be found in the users list, and the password for this user cannot be changed.

Which software versions are affected by CVE-2023-2611?