CVE-2023-40144
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
The OS command injection vulnerability in CBC products allows a remote authenticated attacker to execute arbitrary OS commands on the device or alter its settings.
Risk Assessment
An attacker could remotely take control of the device, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to discontinue the use of products from the NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series, as they are no longer supported and do not receive updates.
Other vulnerabilities in Produkty CBC, w tym serie NR4H, NR8H, NR16H oraz DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41
See all- CVE-2023-40158High
A hidden functionality vulnerability in CBC products allows a remote authenticated attacker to execute arbitrary OS commands on the device or alter its settings.
- CVE-2023-38585High
The vulnerability related to improper authentication in CBC products allows a remote authenticated attacker to execute arbitrary OS commands on the device or alter its settings.
Original NVD description (English source)
OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.