Skip to content
Fencer Vulns
high 7.5

CVE-2023-38433 json

Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to init…

published 2023-07-26 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-42250

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.7%
EPSS 3.7% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known, plus a Nuclei check

Summary

Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. Affected products and versions are as follows: IP-HE950E firmware versions V01L001 to V01L053, IP-HE950D firmware versions V01L001 to V01L053, IP-HE900E firmware versions V01L001 to V01L010, IP-HE900D firmware versions V01L001 to V01L004, IP-900E / IP-920E firmware versions V01L001 to V02L061, IP-900D / IP-900ⅡD / IP-920D firmware versions V01L001 to V02L061, IP-90 firmware versions V01L001 to V01L013, and IP-9610 firmware versions V01L001 to V02L007.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-248-01 updated cvss 5.9

Fujitsu Limited Real-time Video Transmission Gear "IP series"

  • Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-90 >= V01L001, < V01L013 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-900D >= V01L001, < V02L061 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-900E >= V01L001, < V02L061 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-900IID >= V01L001, < V02L061 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-920D >= V01L001, < V02L061 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-920E >= V01L001, < V02L061
    +5 more products
    Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-9610 >= V01L001, < V02L007 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-HE900D >= V01L001, < V01L004 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-HE900E >= V01L001, < V01L010 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-HE950D >= V01L001, < V01L053 Fujitsu Limited Real-time Video Transmission Gear "IP series" IP-HE950E >= V01L001, < V01L053
    affected: mitigation “Fujitsu Limited recommends updating the firmware to the latest version, which can be downloaded here.” fujitsu.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

3.72% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Fujitsu IP Series - Hardcoded Credentials nuclei detection template

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Fujitsu Limited IP-HE950E
  • Fujitsu Limited IP-HE950D
  • Fujitsu Limited IP-HE900E
  • Fujitsu Limited IP-HE900D
  • Fujitsu Limited IP-900E / IP-920E
  • Fujitsu Limited IP-900D / IP-900ⅡD / IP-920D
  • Fujitsu Limited IP-90
  • Fujitsu Limited IP-9610
  • fujitsu ip-he950e
  • fujitsu ip-he950d_firmware
  • fujitsu ip-he900e_firmware
  • fujitsu ip-he900d_firmware
  • fujitsu ip-900e_firmware
  • fujitsu ip-920e_firmware
  • fujitsu ip-900d_firmware
  • fujitsu ip-900iid_firmware
  • fujitsu ip-920d_firmware
  • fujitsu ip-90
  • fujitsu ip-9610_firmware

Classification

Weakness
  • CWE-798 Use of Hard-coded Credentials

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.