CVE-2023-0432

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system (OS) from the device in the context of the user "root." If the attacker has credentials for the web service, then the device could be fully compromised.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04337.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1225.CVE-2023-04347.5Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.CVE-2023-04359.8Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.CVE-2023-04367.5The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration CVE-2023-04377.5When calling bson_utf8_validate on some inputs a loop with an exit condition that cannot be reached may occur, i.e. an infinite loop. This i CVE-2023-04386.5Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-04395.4The NEX-Forms WordPress plugin before 8.4.4 does not escape its form name, which could lead to Stored Cross-Site Scripting issues. By defaul CVE-2023-04405.3Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.CVE-2023-04418.1The Gallery Blocks with Lightbox WordPress plugin before 3.0.8 has an AJAX endpoint that can be accessed by any authenticated users, such as CVE-2023-04426.1The Loan Comparison WordPress plugin before 1.5.3 does not validate and escape some of its query parameters before outputting them back in a CVE-2023-04435.3The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro CVE-2023-04448.8A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. A default user 'User', which is in the