CVE-2023-3606
MediumCVSS 6.3Exploitation Probability (EPSS)
Very high risk92th percentile - higher than 92% of all known CVEs
Summary
A critical vulnerability was found in TamronOS up to version 20230703, affecting an unknown part of the file /api/ping. Manipulation of the host argument leads to OS command injection.
Risk Assessment
This vulnerability allows for remote exploitation, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update TamronOS to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Original NVD description (English source)
A vulnerability was found in TamronOS up to 20230703. It has been classified as critical. This affects an unknown part of the file /api/ping. The manipulation of the argument host leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233475. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.