CVE-2023-23594

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides remote unauthenticated attackers with access to execute commands intended only for valid/authenticated users, such as file uploads and configuration changes.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://d2n1rly8br52rx.cloudfront.net/content-blocks/files/pages/Vulnerability-Disclosure.pdfVendor Advisory
https://hackandpwn.com/disclosures/CVE-2023-23594.pdfThird Party Advisory
https://www.satoamerica.com/products/printers/industrial-thermal-printers/cl4nx-plusProduct
https://d2n1rly8br52rx.cloudfront.net/content-blocks/files/pages/Vulnerability-Disclosure.pdfVendor Advisory
https://hackandpwn.com/disclosures/CVE-2023-23594.pdfThird Party Advisory
https://www.satoamerica.com/products/printers/industrial-thermal-printers/cl4nx-plusProduct

Timeline

Published: Mar 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235957.5BlueCat Device Registration Portal 2.2 allows XXE attacks that exfiltrate single-line files. A single-line file might contain credentials, s CVE-2023-235968.8jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with CVE-2023-235976.5A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the `fi CVE-2023-235986.5Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dr CVE-2023-235996.5When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow CVE-2023-23607.5Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber Infrastructure (ACI) befor CVE-2023-236006.5Per origin notification permissions were being stored in a way that didn't take into account what browsing context the permission was grante CVE-2023-236016.5Navigations were being allowed when dragging a URL from a cross-origin iframe into the same tab which could lead to website spoofing attacks CVE-2023-236026.5A mishandled security check when creating a WebSocket in a WebWorker caused the Content Security Policy connect-src header to be ignored. Th CVE-2023-236036.5Regular expressions used to filter out forbidden properties and values from style directives in calls to `console.log` weren't accounting fo CVE-2023-236046.5A duplicate `SystemPrincipal` object could be created when parsing a non-system html document via `DOMParser::ParseFromSafeString`. This cou CVE-2023-236058.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108 and Firefox ESR 102.6. Some of these bugs