CVE-2023-27573

{"id": "CVE-2023-27573", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-11T06:17:11.933", "references": [{"url": "https://github.com/netbox-community/netbox-docker/issues/953", "tags": ["Exploit", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/netbox-community/netbox-docker/pull/959", "tags": ["Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/netbox-community/netbox-docker/releases/tag/2.5.0", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-1392"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment."}, {"lang": "es", "value": "netbox-docker anterior a la versi\u00f3n 2.5.0 tiene una cuenta de superusuario con credenciales predeterminadas (contrase\u00f1a 'admin' para la cuenta 'admin', y el valor 0123456789abcdef0123456789abcdef01234567 para SUPERUSER_API_TOKEN). En la pr\u00e1ctica, en la Internet p\u00fablica, casi todos los usuarios cambiaron la contrase\u00f1a, pero solo alrededor del 90% cambi\u00f3 el token. Tener un valor de token predeterminado fue intencional y fue valioso para el caso de uso principal previsto del producto netbox-docker (redes de desarrollo aisladas). Algunos usuarios se embarcaron en un esfuerzo para reutilizar netbox-docker para producci\u00f3n. La documentaci\u00f3n para este esfuerzo indicaba que los valores predeterminados no deb\u00edan usarse. Sin embargo, la instalaci\u00f3n no garantizaba valores no predeterminados. El Proveedor estaba al tanto de la asignaci\u00f3n del ID de CVE y no se opuso a la asignaci\u00f3n."}], "lastModified": "2026-05-07T18:13:07.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netboxlabs:netbox-docker:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D08B9C-EB2C-403D-973C-4E40EAB484FC", "versionEndExcluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}