CVE-2023-39809

CriticalCVSS 9.8

Published: 21/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.27%

66th percentile - higher than 66% of all known CVEs

Summary

An OS command injection vulnerability was discovered in iBSG v3.5 by N.V.K.INTER CO., LTD. (NVK). The flaw exists in the system_hostname parameter at /manage/network-basic.php, allowing shell metacharacters to be injected.

Risk Assessment

An attacker can remotely execute arbitrary system commands on the server, leading to full device compromise, data theft, or network disruption.

Recommendation

Immediately update iBSG to the latest version and implement input filtering for the system_hostname parameter to block shell metacharacters.

Original NVD description (English source)

N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter at /manage/network-basic.php.