CVE-2023-38336

CriticalCVSS 9.8

Published: 14/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

1.76%

75th percentile - higher than 75% of all known CVEs

Summary

Netkit-rcp in rsh-client version 0.17-24 allows command injection via filenames because /bin/sh is used by susystem. This is related to issues described in CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.

Risk Assessment

Exploitation of this vulnerability could lead to unauthorized command execution on the system, posing a serious security threat to the organization.

Recommendation

It is recommended to update rsh-client to the latest version to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

netkit-rcp in rsh-client 0.17-24 allows command injection via filenames because /bin/sh is used by susystem, a related issue to CVE-2006-0225, CVE-2019-7283, and CVE-2020-15778.