CVE-2023-27573

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-27573
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27573.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-27573
Published
2026-03-11T06:17:11.933Z
Modified
2026-03-14T08:44:55.044706Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSERAPITOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment.

References

Affected packages

Git / github.com/netbox-community/netbox-docker

Affected ranges

Type
GIT
Repo
https://github.com/netbox-community/netbox-docker
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
93017f150e3ed86de4a9a70f20a15a09de1bb00b
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.0"
        }
    ]
}

Affected versions

0.*
0.10.0
0.11.0
0.12.0
0.13.0
0.13.1
0.14.0
0.15.0
0.16.0
0.17.0
0.17.1
0.18.0
0.18.1
0.18.2
0.19.0
0.19.1
0.19.2
0.19.3
0.19.4
0.20.0
0.21.0
0.21.1
0.22.0
0.23.0
0.24.0
0.24.1
0.25.0
0.26.0
0.26.1
0.26.2
0.27.0
0.3.1
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.0
0.9.0
1.*
1.0.0
1.0.1
1.0.2
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0
1.6.1
2.*
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-27573.json"