CRITICAL🇵🇱 Wersja polska

CVE-2023-33374

CVSS 9.8v3.1pub. 2023-08-04upd. 2024-11-21

Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Connectedio Connected Io

    APP
    Connectedio
    ≤ 2.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2023-33372CRITICAL9.8PL ✓same product

Hard-coded credentials w firmware Connected IO umożliwiają bypass uwierzytelnienia

CVE-2023-33373CRITICAL9.8PL ✓same product

Connected IO: przechowywanie haseł i danych uwierzytelniających w postaci jawnego tekstu

CVE-2023-33375CRITICAL9.8PL ✓same product

Stack-based buffer overflow w protokole komunikacyjnym Connected IO

CVE-2023-33376CRITICAL9.8PL ✓same product

Argument injection w protokole iptables — Connected IO v2.1.0

CVE-2023-33377CRITICAL9.8PL ✓same product

Command Injection w Connected IO — wykonanie dowolnych poleceń przez sieć