CVE-2023-49256

CVE-2023-49256: Predictable encryption passphrase used in publicly accessible configuration file

Vendor Hongdian

Product H8951-4G-ESP

Weakness CWE-321

Published January 12, 2024

Last update June 20, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key.

Key dates

02Disclosure timeline

January 12, 2024 CVE published

June 20, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-49256 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/321.html

Related vulnerabilities

04Related CVE

CVE-2022-1400 Hardcoded encryption key IV in Exago WebReportsApi.dll CVE-2025-34211 Vasion Print (formerly PrinterLogic) Hardcoded SSL Certificate and Private Keys CVE-2025-30234 CVE-2021-0266 cSRX: Use of Hard-coded Cryptographic Keys allows an attacker to take control of the device through device management services. CVE-2020-7846