CVE-2023-39171 - OpenCVE

SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Enbw	Senec Storage Box Senec Storage Box Firmware

Configuration 1 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v1:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v2:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:enbw:senec_storage_box_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:enbw:senec_storage_box:v3:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2023/Nov/2
https://seclists.org/fulldisclosure/2023/Nov/2

History

Tue, 04 Nov 2025 20:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2023/Nov/2

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2023-12-07T14:23:57.124Z

Updated: 2025-11-04T19:17:39.942Z

Reserved: 2023-07-25T14:06:01.345Z

Link: CVE-2023-39171

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-07T15:15:09.990

Modified: 2025-11-04T20:16:35.690

Link: CVE-2023-39171

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-39171", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2023-07-25T14:06:01.345Z", "datePublished": "2023-12-07T14:23:57.124Z", "dateUpdated": "2025-11-04T19:17:39.942Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Storage Box V1", "vendor": "SENEC", "versions": [{"status": "affected", "version": "before Nov. 2023"}]}, {"defaultStatus": "unaffected", "product": "Storage Box V2", "vendor": "SENEC", "versions": [{"status": "affected", "version": "before Nov. 2023"}]}, {"defaultStatus": "unaffected", "product": "Storage Box V3", "vendor": "SENEC", "versions": [{"status": "affected", "version": "before Nov. 2023"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Ph0s[4]"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "R0ckE7"}], "datePublic": "2023-12-07T14:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials."}], "value": "SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-668", "description": "CWE-668 Exposure of Resource to Wrong Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2023-12-07T14:23:57.124Z"}, "references": [{"url": "https://seclists.org/fulldisclosure/2023/Nov/2"}], "source": {"defect": ["CERT@VDE#64567"], "discovery": "UNKNOWN"}, "title": "SENEC Storage Box V1,V2 and V3 accidentially expose a management interface", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://seclists.org/fulldisclosure/2023/Nov/2", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Nov/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-04T19:17:39.942Z"}}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C6796ED-84F3-47E8-BD21-5CEBC1DD62E0", "versionEndIncluding": "2023-06-19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v1:*:*:*:*:*:*:*", "matchCriteriaId": "1A73E447-D78F-420B-B256-1F157A6DA364", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C6796ED-84F3-47E8-BD21-5CEBC1DD62E0", "versionEndIncluding": "2023-06-19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v2:*:*:*:*:*:*:*", "matchCriteriaId": "300B219B-45CA-44C0-AC39-D94057FA8860", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:enbw:senec_storage_box_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C6796ED-84F3-47E8-BD21-5CEBC1DD62E0", "versionEndIncluding": "2023-06-19", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:enbw:senec_storage_box:v3:*:*:*:*:*:*:*", "matchCriteriaId": "449C542C-CAE3-42A9-BF45-EE6E828A4EBE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SENEC Storage Box V1,V2 and V3 accidentially expose a management UI accessible with publicly known admin credentials."}, {"lang": "es", "value": "SENEC Storage Box V1, V2 y V3 exponen accidentalmente una interfaz de usuario de administraci\u00f3n a la que se puede acceder con credenciales de administrador conocidas p\u00fablicamente."}], "id": "CVE-2023-39171", "lastModified": "2025-11-04T20:16:35.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}]}, "published": "2023-12-07T15:15:09.990", "references": [{"source": "[email protected]", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2023/Nov/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2023/Nov/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://seclists.org/fulldisclosure/2023/Nov/2"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "[email protected]", "type": "Secondary"}]}