CVE-2023-28354

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in Opsview Monitor Agent 6.8. An unauthenticated remote attacker can call check_nrpe against affected targets, specifying known NRPE plugins, which in default installations are configured to accept command control characters and pass them to command-line interpreters for NRPE plugin execution. This allows the attacker to escape NRPE plugin execution and execute commands remotely on the target as NT_AUTHORITY\SYSTEM.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-283567.5A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can cause the chat to ente CVE-2023-283574.3A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a CVE-2023-283586.1A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of m CVE-2023-283595.3A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthen CVE-2023-28364.8The CRM Perks Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form settings in versions up to, and including, 1.CVE-2023-283604.3An omission of security-relevant information vulnerability exists in Brave desktop prior to version 1.48.171 when a user was saving a file t CVE-2023-283616.5A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confiden CVE-2023-283624.0The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in th CVE-2023-283646.1An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned CVE-2023-283659.1A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application a CVE-2023-283667.5The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 CVE-2023-283675.4Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated a