CVE-2023-54329
CriticalSummary
Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.
Risk Assessment
Remote code execution with system privileges can lead to full compromise of the system and network, posing a critical threat.
Recommendation
Immediately upgrade Inbit Messenger to a version newer than 4.9.0 or implement network security measures to block access to port 10883.
Original NVD description (English source)
Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.