CVE-2023-43743

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to the /newapi/ endpoint in the Zultys MX web interface.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Dec 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-437447.2An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 p CVE-2023-437452.8Improper input validation in some Intel(R) CBI software before version 1.1.0 may allow an authenticated user to potentially enable denial of CVE-2023-437468.7When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, uti CVE-2023-437476.7Incorrect default permissions for some Intel(R) Connectivity Performance Suite software installers before version 2.0 may allow an authentic CVE-2023-437487.8Improper access control in some Intel(R) GPA Framework software installers before version 2023.3 may allow an authenticated user to potentia CVE-2023-437516.7Uncontrolled search path in Intel(R) Graphics Command Center Service bundled in some Intel(R) Graphics Windows DCH driver software before ve CVE-2023-437528.0OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earl CVE-2023-437535.3Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enable information disclo CVE-2023-437544.3Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowi CVE-2023-437559.8Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.0 CVE-2023-437565.5in OpenHarmony v3.2.4 and prior versions allow a local attacker causes information leak through out-of-bounds Read.CVE-2023-437576.5Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION allows a network-adjace