CVE-2023-36670
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A remotely exploitable command injection vulnerability was found on Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing attackers full access to the system, which could lead to data loss or device takeover.
Recommendation
It is recommended to immediately update the software to the latest version to mitigate this vulnerability and to monitor network traffic for potential attack attempts.
Original NVD description (English source)
A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.