CVE-2023-26213 : On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089

On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.

Published 2023-03-03 22:15:10

Updated 2023-03-10 14:53:14

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-26213

Barracuda » T100b Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t100b_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T100b » Version: N/A
Barracuda » T200c Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t200c_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T200c » Version: N/A
Barracuda » T400c Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t400c_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T400c » Version: N/A
Barracuda » T600d Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t600d_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T600d » Version: N/A
Barracuda » T900b Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t900b_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T900b » Version: N/A
Barracuda » T93a Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t93a_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T93a » Version: N/A
Barracuda » T193a Firmware » Version: 8.3.1
cpe:2.3:o:barracuda:t193a_firmware:8.3.1:-:*:*:*:*:*:*
Matching versions
When used together with: Barracuda » T193a » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-26213

EPSS FAQ

0.82%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 82 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-26213

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-26213

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-26213

https://www.barracuda.com/products/network-security/cloudgen-wan

Barracuda CloudGen WAN | Barracuda Networks
Product
https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/

Release Notes 8.3.1 | Barracuda Campus
Release Notes
http://seclists.org/fulldisclosure/2023/Mar/2

Full Disclosure: SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN
Exploit;Mailing List;Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/

OS Command Injection in Barracuda CloudGen WAN
Exploit;Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-26213

Products affected by CVE-2023-26213

Exploit prediction scoring system (EPSS) score for CVE-2023-26213

CVSS scores for CVE-2023-26213

CWE ids for CVE-2023-26213

References for CVE-2023-26213