CVE-2023-49253

The manufacturer embedded a hardcoded root account password directly into the device firmware. This password is identical for all device units and cannot be changed by the administrator through the user interface. This means that anyone who knows this password can log in to the root account on any device of this model.

An attacker can gain full root access to the device, enabling complete device takeover, configuration modification, network traffic interception, and potential use of the device as an entry point to the internal network.

Apply patches available from the manufacturer according to the references. Until firmware is updated, it is recommended to isolate devices from public network access, use firewalls to restrict access to management ports, and monitor unauthorized login attempts.

Hongdian H8951-4G-Esp Firmware — versions indicated in manufacturer references