CVE-2023-40796

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published
Aug 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-407978.8In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authenticatCVE-2023-407988.8In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting CVE-2023-407999.8Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function.CVE-2023-408008.8The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulneCVE-2023-408018.8The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.CVE-2023-408026.5The get_parentControl_list_Info function does not verify the parameters entered by the user, causing a post-authentication heap overflow vulCVE-2023-408096.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number.CVE-2023-408106.1OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field.CVE-2023-408126.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field.CVE-2023-408136.1OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation.CVE-2023-408146.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field.CVE-2023-408156.1OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field.
CVE-2023-40796: High severity, CVSS 7.8 | Vulnix