CVE-2023-48248

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script code and obtain its execution inside a victim’s session via a crafted URL, HTTP request, or simply by waiting for the victim to view the poisoned file.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
RexrothNexo cordless nutrunner NXA015S-36V (0608842001)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA030S-36V (0608842002)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA050S-36V (0608842003)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXP012QD-36V (0608842005)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA015S-36V-B (0608842006)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA030S-36V-B (0608842007)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA050S-36V-B (0608842008)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXP012QD-36V-B (0608842010)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA011S-36V (0608842011)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA011S-36V-B (0608842012)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA065S-36V (0608842013)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXA065S-36V-B (0608842014)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXV012T-36V (0608842015)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo cordless nutrunner NXV012T-36V-B (0608842016)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo special cordless nutrunner (0608PE2272)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo special cordless nutrunner (0608PE2301)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo special cordless nutrunner (0608PE2514)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo special cordless nutrunner (0608PE2515)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo special cordless nutrunner (0608PE2666)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2
RexrothNexo special cordless nutrunner (0608PE2673)>= NEXO-OS V1000-Release, <= NEXO-OS V1500-SP2

References

Timeline

Published
Jan 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-482496.5The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the applCVE-2023-482509.8The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded acCVE-2023-482519.8The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account.CVE-2023-482528.8The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests.CVE-2023-482538.8The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HTCVE-2023-482546.1The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted UCVE-2023-482556.1The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code CVE-2023-482566.3The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s seCVE-2023-482578.8The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) witCVE-2023-482588.1The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’CVE-2023-482597.5The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request.CVE-2023-48266.1The SocialDriver WordPress theme before version 2024 has a prototype pollution vulnerability that could allow an attacker to inject arbitrar
CVE-2023-48248: Medium severity, CVSS 5.4 | Vulnix