CVE-2023-43478

high · 8.8

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root.

8.8

CVSS

17.4%

EPSS (exploit prob.)

97th

EPSS percentile

2023-09-20

Published

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-434

Affected products

Vendor	Product	Affected versions
telstra	arcadyan_lh1000_firmware	< 0.18.15r
telstra	arcadyan_lh1000	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.tenable.com/security/research/tra-2023-19
https://www.tenable.com/security/research/tra-2023-19

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-43478