CRITICAL
OTCMS hard-coded password
Published Jun 14, 2023
9.8
CRITICALCVSS 3.1
EPSS 0.93%
Description
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
Affected products
- Vendor n/a Product Otcms Defaultn/a
- Version 6.0StatusaffectedConstraints-
- Version 6.1StatusaffectedConstraints-
- Version 6.10StatusaffectedConstraints-
- Version 6.11StatusaffectedConstraints-
- Version 6.12StatusaffectedConstraints-
- Version 6.13StatusaffectedConstraints-
- Version 6.14StatusaffectedConstraints-
- Version 6.15StatusaffectedConstraints-
- Version 6.16StatusaffectedConstraints-
- Version 6.17StatusaffectedConstraints-
- Version 6.18StatusaffectedConstraints-
- Version 6.19StatusaffectedConstraints-
- Version 6.2StatusaffectedConstraints-
- Version 6.20StatusaffectedConstraints-
- Version 6.21StatusaffectedConstraints-
- Version 6.22StatusaffectedConstraints-
- Version 6.23StatusaffectedConstraints-
- Version 6.24StatusaffectedConstraints-
- Version 6.25StatusaffectedConstraints-
- Version 6.26StatusaffectedConstraints-
- Version 6.27StatusaffectedConstraints-
- Version 6.28StatusaffectedConstraints-
- Version 6.29StatusaffectedConstraints-
- Version 6.3StatusaffectedConstraints-
- Version 6.30StatusaffectedConstraints-
- Version 6.31StatusaffectedConstraints-
- Version 6.32StatusaffectedConstraints-
- Version 6.33StatusaffectedConstraints-
- Version 6.34StatusaffectedConstraints-
- Version 6.35StatusaffectedConstraints-
- Version 6.36StatusaffectedConstraints-
- Version 6.37StatusaffectedConstraints-
- Version 6.38StatusaffectedConstraints-
- Version 6.39StatusaffectedConstraints-
- Version 6.4StatusaffectedConstraints-
- Version 6.40StatusaffectedConstraints-
- Version 6.41StatusaffectedConstraints-
- Version 6.42StatusaffectedConstraints-
- Version 6.43StatusaffectedConstraints-
- Version 6.44StatusaffectedConstraints-
- Version 6.45StatusaffectedConstraints-
- Version 6.46StatusaffectedConstraints-
- Version 6.47StatusaffectedConstraints-
- Version 6.48StatusaffectedConstraints-
- Version 6.49StatusaffectedConstraints-
- Version 6.5StatusaffectedConstraints-
- Version 6.50StatusaffectedConstraints-
- Version 6.51StatusaffectedConstraints-
- Version 6.52StatusaffectedConstraints-
- Version 6.53StatusaffectedConstraints-
- Version 6.54StatusaffectedConstraints-
- Version 6.55StatusaffectedConstraints-
- Version 6.56StatusaffectedConstraints-
- Version 6.57StatusaffectedConstraints-
- Version 6.58StatusaffectedConstraints-
- Version 6.59StatusaffectedConstraints-
- Version 6.6StatusaffectedConstraints-
- Version 6.60StatusaffectedConstraints-
- Version 6.61StatusaffectedConstraints-
- Version 6.62StatusaffectedConstraints-
- Version 6.7StatusaffectedConstraints-
- Version 6.8StatusaffectedConstraints-
- Version 6.9StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| n/a | Otcms | n/a |
|
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
9.8 CRITICAL NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
1 other source (CVE.org) ▾
6.3 MEDIUM CVE.org
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact Low
6.3 MEDIUM CVE.org
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact Low
Integrity Impact Low
Availability Impact Low
5.8 MEDIUM CVE.org
AV:A/AC:L/Au:N/C:P/I:P/A:P
Access Vector Adjacent
Access Complexity Low
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed Jul 18, 2024 · SSVC 2.0.3
0.93% 0.00932
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
EPSS probability 0.00932
Score over time
2023–2026- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (9 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.93% (0.00932) | 59.35th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.93% (0.00932) | 55.89th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.34% (0.00337) | 54.35th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.14% (0.00144) | 51.83th | v3 (v2023.03.01) |
| Jul 16, 2024 | 0.13% (0.00132) | 48.67th | v3 (v2023.03.01) |
| Jun 20, 2024 | 0.12% (0.00117) | 45.79th | v3 (v2023.03.01) |
| May 14, 2024 | 0.07% (0.00069) | 29.56th | v3 (v2023.03.01) |
| Jun 24, 2023 | 0.06% (0.00063) | 25.52th | v3 (v2023.03.01) |
| Jun 14, 2023 | 0.04% (0.00045) | 12.29th | v3 (v2023.03.01) |
Weaknesses (2)
References (3)
- https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md broken-linkexploit
- https://vuldb.com/?ctiid.231508 signaturepermissions-requiredPermissions RequiredThird Party Advisory
- https://vuldb.com/?id.231508 vdb-entrytechnical-descriptionThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md | broken-linkexploit | |
| https://vuldb.com/?ctiid.231508 | signaturepermissions-requiredPermissions RequiredThird Party Advisory | |
| https://vuldb.com/?id.231508 | vdb-entrytechnical-descriptionThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Jun 14, 2023
Updated Aug 2, 2024
Reserved Jun 14, 2023
Link CVE-2023-3237
CISA Vulnrichment
Updated Jul 18, 2024