CVE-2023-38378

CriticalCVSS 9.8

Published: 16/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.23%

65th percentile - higher than 65% of all known CVEs

Summary

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in the changepwd.cgi application.

Risk Assessment

Attackers can remotely take control of the device, potentially leading to serious security implications.

Recommendation

It is recommended to update the oscilloscope's firmware to the latest version and restrict access to the web interface.

Original NVD description (English source)

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.