CVE-2023-47352 affects Technicolor TC8715D devices, whose default WPA2 password can be predicted from the network name and hardware address that the device broadcasts. NVD scores it 8.8, High. No fixed firmware is named in the sources I could read, so change the WiFi password to your own value now.
What's affected
The record lists the Technicolor TC8715D hardware and its firmware, with no version range. The researcher write-up names the TC8715D without a version as well. No vendor advisory is cited in the record, so I cannot confirm a fixed firmware release. Check with the device's supplier or Technicolor for a current build.
The NVD vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The A in AV:A means adjacent: the attacker has to be in radio range of the network, not on the internet.
The record carries no weakness identifier. The researcher write-up names CWE-1392, use of default credentials, which fits the description.
Source note: the write-up lists denial of service, privilege escalation and information disclosure as possible impacts once an attacker is on the network. NVD's vector rates confidentiality, integrity and availability all High. Those line up.
How to check if you're exposed
You can check this without any tooling. Look at the label on the device or the admin page for the original default WiFi password, and compare it with the current network password. If the password is still the one the device shipped with, treat it as predictable.
If the device came from a service provider, ask them whether they changed the password during setup. Devices handed out in bulk are the most likely to keep the shipped value.
The write-up describes the weakness as a pattern built from the first six characters of the network name and the last six characters of the hardware address. Because those two values are broadcast by the access point itself, anyone nearby can see them. I am not repeating the exact construction here beyond what the advisory level needs.
What to do now
- Change the WiFi password to a long, random value of your own. Use WPA2 or WPA3 personal mode with a passphrase of at least 16 characters.
- Change the router admin password too, if it is still a default.
- Ask the supplier or Technicolor whether a firmware update changes how default passwords are created, and apply it if one exists.
- Move guest and IoT devices to a separate network, so one shared password does not open your main one.
- If the device is on a business site, list it in your asset inventory so a future firmware advisory reaches someone.
Why it matters
A default password that can be derived from public information is not a secret. The attacker does not need to guess or crack anything. They read two values off the air and compute the third. That is why the attack complexity is Low in the NVD vector, even though the attacker must be within radio range.
The class of problem is default credentials, CWE-1392. It shows up across home routers, cameras and cable gateways because shipping a unique, truly random password per unit costs money at manufacturing time. Passwords derived from other device identifiers are cheaper, and also guessable once the pattern is known.
For a business, the risk is less the home router than the ones in small branch offices, pop-up sites and contractor locations. Once on the network, an attacker is behind the perimeter firewall. Changing one password closes it. The control is cheap, and it is also the only mitigation I can confirm from the sources.
Quick check
Is there a patch for CVE-2023-47352?
I could not confirm one. The record cites only a researcher write-up, not a vendor advisory. Changing the default WiFi password removes the predictable value.
Can this be exploited over the internet?
No. NVD marks the attack vector as adjacent, which means the attacker needs to be in WiFi range.
Sources
Last reviewed: 19 October 2026.
