CVE-2023-37608 is a high severity (CVSS 7.5) hardcoded credential flaw in the Automatic Systems SOC FL9600 FirstLane, version V06. The firmware ships a super admin account with a fixed password, so a remote attacker can read sensitive information. The record names no fix, so isolate the units and ask the vendor.
What's affected
The record covers the Automatic Systems SOC FL9600 FirstLane firmware version 06 (build lego_T04E00) and the matching hardware. It scores the flaw 7.5 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. In plain terms the attack comes over the network and needs no account and no user interaction, with a high impact on confidentiality only.
The record says the firmware contains a super admin account named automaticsystems with a hardcoded password. We do not repeat the password here. The weakness is CWE-798 (use of hard-coded credentials), which covers credentials baked into a product that every unit shares and that the owner cannot change through normal settings.
No fixed version is listed. The references are the CQURE write up on GitHub and the vendor's product range page, and we could not confirm a patch from either. The record does not flag CISA KEV, and nothing we read says the flaw is exploited in the wild.
How to check if you're exposed
Ask the vendor or your integrator which firmware and build each unit runs, and compare with V06 and lego_T04E00.
Check whether you can change or disable the built in account on your units through the admin interface. If you can, do so and record it. If you cannot, treat the account as permanently known to attackers.
Check where the units listen. Firewall rules, remote support tunnels and port forwards that expose the web interface are the exposure that matters, because the account is only useful to someone who can reach the login page.
Look at authentication logs, if the unit keeps any, for logins to the super admin account from hosts that are not yours.
What to do now
- Inventory all FirstLane units and their firmware builds.
- Ask Automatic Systems for a firmware that removes or lets you change the fixed account, and record the reply.
- Isolate the units on a management network, with access only from named administration hosts.
- Block inbound access from the internet, and remove any port forwards or open remote access to the units.
- Set up alerts for logins to the device from unexpected addresses, using whatever logging the network gives you.
Why it matters
Hardcoded credentials turn one reverse engineering session into a key for every unit that ever shipped. Once the account and password are known, as they are in the public record, the only thing between an attacker and the device is network access. That is why this class of flaw gets a high score even though it needs no clever technique.
Operators of lane and access systems often hand devices to integrators who set them up once. If those units sit on a flat network or are reachable for remote support, the fixed account is a standing risk. Segmentation, an allow list of management hosts and a vendor patch request are the realistic steps. The same product also has a path traversal record, CVE-2023-37607.
Quick check
Can I change the password?
The record does not say. Check the admin interface and ask the vendor. If you cannot change it, rely on network isolation.
Is this exploited in the wild?
The record does not flag it as a CISA KEV entry and nothing we read reports exploitation. The credential is public, so do not rely on that.
Sources
- CQURE write up for CVE-2023-37608
- Vendor product range page (linked from the record; no advisory or fix was found there that we could confirm)
- CVE-2023-37608 on Gold
Last reviewed: 19 October 2026.
