CVE-2023-4873

medium · 6.3

A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability.

6.3

CVSS

22.1%

EPSS (exploit prob.)

98th

EPSS percentile

2023-09-10

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
byzoro	smart_s45f_firmware	<= 20230906
byzoro	smart_s45f	all versions

Check a specific version with /api/v1/cve/match.

References

https://github.com/cugerQDHJ/cve/blob/main/rce.md
https://vuldb.com/?ctiid.239358
https://vuldb.com/?id.239358
https://vuldb.com/?submit.204279
https://github.com/cugerQDHJ/cve/blob/main/rce.md
https://vuldb.com/?ctiid.239358
https://vuldb.com/?id.239358
https://vuldb.com/?submit.204279

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-4873