CVE-2023-46870

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

extcap/nrf_sniffer_ble.py, extcap/nrf_sniffer_ble.sh, extcap/SnifferAPI/*.py in Nordic Semiconductor nRF Sniffer for Bluetooth LE 3.0.0, 3.1.0, 4.0.0, 4.1.0, and 4.1.1 have set incorrect file permission, which allows attackers to do code execution via modified bash and python scripts.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
nordicsemi	nrf_sniffer_for_bluetooth	3.0.0; 3.1.0; 4.0.0; 4.1.0; 4.1.1

References

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-468715.3GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerabilit CVE-2023-46885.5Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433.CVE-2023-468869.1Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the t CVE-2023-468877.5In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.CVE-2023-468895.7Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an CVE-2023-46894.3The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This CVE-2023-468928.8The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record CVE-2023-468947.5An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.CVE-2023-46904.3The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This CVE-2023-469064.9juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in th CVE-2023-46917.2The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a parameter before usi CVE-2023-469116.1There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend.