CVE-2023-39809
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
An OS command injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK). The flaw exists in the system_hostname parameter at /manage/network-basic.php, allowing shell metacharacters to be injected.
Risk Assessment
An attacker can remotely execute arbitrary system commands on the server, leading to full device compromise, data theft, or network disruption.
Recommendation
Immediately update iBSG to the latest version and implement input filtering for the system_hostname parameter to block shell metacharacters.
Other vulnerabilities in iBSG
See all- CVE-2023-39808Critical
A hardcoded root password was discovered in N.V.K.INTER CO., LTD. (NVK) iBSG v3.5. This allows attackers to log in with root privileges via SSH.
- CVE-2023-39807Critical
A SQL injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK) via the a_passwd parameter at /portal/user-register.php. This flaw allows an attacker to manipulate database queries.
Original NVD description (English source)
N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter at /manage/network-basic.php.