CVE-2023-37292

CriticalCVSS 9.8

Published: 21/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.13%

62th percentile - higher than 62% of all known CVEs

Summary

CVE-2023-37292 describes an improper neutralization of special elements used in OS commands, allowing OS command injection in iSherlock 4.5 and 5.5 user modules. This issue affects iSherlock 4.5 before iSherlock-user-4.5-174 and iSherlock 5.5 before iSherlock-user-5.5-174.

Risk Assessment

Exploitation of this vulnerability may lead to unauthorized execution of OS commands, posing a significant security risk to the organization's systems and data.

Recommendation

It is recommended to upgrade to iSherlock-user-4.5-174 or iSherlock-user-5.5-174 to mitigate this vulnerability.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.