CVE-2023-47213
📋 TL;DR
First Corporation DVRs contain a hard-coded password vulnerability that allows remote unauthenticated attackers to access and modify device configuration. This affects multiple DVR models from First Corporation, with only some models receiving security updates while others require workarounds.
💻 Affected Systems
- First Corporation DVRs including CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, MD-808AB and other unspecified models
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover allowing attackers to reconfigure DVRs, disable security features, access video feeds, or use devices as part of botnets for DDoS attacks.
Likely Case
Unauthorized access to video surveillance feeds, device configuration tampering, and potential use of devices in coordinated attacks.
If Mitigated
Limited impact if devices are behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
The vulnerability requires network access to the DVR's management interface. Attackers can use automated tools to scan for vulnerable devices.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Updates available for Late models only
Vendor Advisory: https://www.c-first.co.jp/information/ddososhirase/
Restart Required: Yes
Instructions:
1. Check if your DVR model is a Late model of CFR-4EABC, CFR-4EAB, CFR-8EAB, CFR-16EAB, MD-404AB, or MD-808AB. 2. If yes, apply firmware update from vendor. 3. If no, implement workarounds. 4. Change all default credentials after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate DVRs from internet and restrict network access
Access Control Lists
allImplement firewall rules to restrict access to DVR management interfaces
🧯 If You Can't Patch
- Remove DVRs from internet-facing networks and place behind VPN or secure gateway
- Implement strict network segmentation to isolate DVRs from critical networks
🔍 How to Verify
Check if Vulnerable:
Attempt to access DVR web interface using default/hard-coded credentials. Check device model against affected list.Check Version:
Check firmware version through DVR web interface or device displayVerify Fix Applied:
Verify firmware version has been updated and test that hard-coded credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful login with default credentials
- Configuration changes from unknown IP addresses
- Multiple login attempts from single sources
Network Indicators:
- Unusual outbound traffic from DVR devices
- Connections to known malicious IPs from DVRs
- Port scanning originating from DVR network segments
SIEM Query:
source_ip="DVR_IP" AND (event_type="authentication" AND result="success" AND user="default") OR (event_type="configuration_change" AND user!="authorized_user")🔗 References
- https://jvn.jp/en/vu/JVNVU99077347/
- https://www.c-first.co.jp/information/ddososhirase/
- https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf
- https://jvn.jp/en/vu/JVNVU99077347/
- https://www.c-first.co.jp/information/ddososhirase/
- https://www.c-first.co.jp/wp/wp-content/uploads/2023/11/tuushin.pdf
