CVE-2023-3206
MediumCVSS 5.3Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
A vulnerability was found in Chengdu VEC40G 3.0 that allows remote denial of service by manipulating the 'restart' argument in the /send_order.cgi file. Inputting 'reboot' leads to system failure.
Risk Assessment
This vulnerability poses a risk of remote disruption of system operations, potentially leading to downtime for the organization. The public disclosure of the exploit increases the likelihood of an attack.
Recommendation
It is recommended to immediately block access to the vulnerable endpoint and monitor the system for potential attack attempts. Contacting the vendor for security updates is also advised.
Original NVD description (English source)
A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231229 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.