Skip to content
Fencer Vulns
low 3.9

CVE-2023-0808 json

Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded password

published 2023-02-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12813

cvss
3.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

A vulnerability was found in Deye/Revolt/Bosswerk Inverter MW3_15U_5406_1.47/MW3_15U_5406_1.471. It has been rated as problematic. This issue affects some unknown processing of the component Access Point Setting Handler. The manipulation with the input 12345678 leads to use of hard-coded password. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version MW3_16U_5406_1.53 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-220769 was assigned to this vulnerability.

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • heise.de https://heise.de/-7483376 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 3.9 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 3.0 3.9 CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 2.0 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P
NVD 3.1 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Deye Inverter
  • Revolt Inverter
  • Bosswerk Inverter

Classification

Weakness
  • CWE-259 Use of Hard-coded Password
  • CWE-798 Use of Hard-coded Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.