CVE-2023-37469
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, an authenticated user who successfully connects to a controlled SMB server can execute arbitrary commands.
Risk Assessment
The risk is that a malicious user could exploit this vulnerability to perform unauthorized actions on the system, potentially leading to data loss or system takeover.
Recommendation
It is recommended to upgrade to version 0.4.4 or later to patch this vulnerability and secure the system against potential attacks.
Other vulnerabilities in CasaOS
See all- CVE-2023-37266Critical
CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as `root` on CasaOS instances.
- CVE-2023-37265Critical
CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances.
- CVE-2025-34171Medium
CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image and /v1/sys/debug endpoints can be abused to access files and disclose host OS, kernel, hardware, and storage details.
Original NVD description (English source)
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.