CVE-2023-22279

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Mahoroba Kobo, Inc.	MAHO-PBX NetDevancer series	MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00

References

https://jvn.jp/en/jp/JVN99957889/index.htmlThird Party Advisory
https://www.ate-mahoroba.jp/netdevancer/manual/Vendor Advisory
https://jvn.jp/en/jp/JVN99957889/index.htmlThird Party Advisory
https://www.ate-mahoroba.jp/netdevancer/manual/Vendor Advisory

Timeline

Published: Jan 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-22286.8Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.CVE-2023-222807.2MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevanc CVE-2023-222817.5On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a CVE-2023-222827.3WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces a CVE-2023-222836.5On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interacti CVE-2023-222857.5Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network CVE-2023-222868.1Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Li CVE-2023-222885.4HTML Email Injection in Tribe29 Checkmk <=2.1.0p23; <=2.0.0p34, and all versions of Checkmk 1.6.0 allows an authenticated attacker to inject CVE-2023-22298.8The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due CVE-2023-222906.5Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access CVE-2023-222917.8An invalid free vulnerability exists in the Frame stream parser functionality of Ichitaro 2022 1.0.1.57600. A specially crafted document can CVE-2023-222927.8Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local ac