CVE-2023-25554

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device.

Affected products: StruxureWare Data Center Expert (V7.9.2 and prior)

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-255558.1A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a CVE-2023-255568.8A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is CVE-2023-255579.1DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backen CVE-2023-255588.8DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j lib CVE-2023-255598.1DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the CVE-2023-25564.3The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing CVE-2023-255609.8DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials,CVE-2023-255619.8DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service (JAAS) authenticat CVE-2023-255629.8DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events a CVE-2023-255637.5GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds CVE-2023-255648.2GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can b CVE-2023-255657.5GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when