CVE-2023-23325
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk75th percentile - higher than 75% of all known CVEs
Summary
A command injection vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80 via the NetHostname parameter. An attacker can remotely execute arbitrary system commands.
Risk Assessment
The risk involves potential unauthorized control over the device, leading to compromise of the lighting system's integrity and confidentiality.
Recommendation
Immediately update the firmware to the latest version and restrict management interface access to trusted networks only.
Other vulnerabilities in Zumtobel Netlink CCD Onboard
See all- CVE-2023-23324Critical
Hardcoded credentials for the Administrator account were discovered in Zumtobel Netlink CCD Onboard firmware versions 3.74-3.80.
- CVE-2023-24294High
A buffer overflow vulnerability was discovered in Zumtobel Netlink CCD Onboard firmware version 3.80 in the NetlinkWeb::Information::SetDeviceIdentification component. This flaw could allow an attacker to execute arbitrary code or cause a denial of service.
Original NVD description (English source)
Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.