CVE-2023-40158

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-912

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-40163.3Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimCVE-2023-401603.7Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 producCVE-2023-401617.8Improper access control in some Intel Unite(R) Client software before version 4.2.35041 may allow an authenticated user to potentially enablCVE-2023-401639.8An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1. A specially cCVE-2023-401645.5Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to global buffer read overflow in `nsCodingSCVE-2023-401657.5rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replacCVE-2023-401665.5Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer read overflow in `FileManagerCVE-2023-401675.3Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` characterCVE-2023-401686.5TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed aCVE-2023-40176.1The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and 'product-cata' parameCVE-2023-401706.1jupyter-server is the backend for Jupyter web applications. Improper cross-site credential checks on `/files/` URLs could allow exposure of CVE-2023-401717.5Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for signing JWT tokens in