Vulnerability Details : CVE-2023-40144
OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
Products affected by CVE-2023-40144
- cpe:2.3:o:cbc:nr4h_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr8h_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr16h_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-16f42a_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-16f45at_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-8f42a_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-8f45at_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-4fx1_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-16h_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-8h_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-4h_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:drh8-4m41-a_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr8-4m71_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr8-8m72_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr-16m_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr-16f85-8pra_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr-16f82-16p_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr-4f_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:nr-8f_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-16m52_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-16m52-av_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-8m52-av_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:cbc:dr-4m51-av_firmware:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-40144
6.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-40144
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2023-40144
-
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.Assigned by: nvd@nist.gov (Primary)
References for CVE-2023-40144
-
https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-notice
Vendor Advisory
-
https://jvn.jp/en/vu/JVNVU92545432/
Third Party Advisory
-
https://download.ganzsecurity.pl/
GANZ™ by CBC - Download Portal - [http://download.ganzsecurity.pl/]Product
Jump to