CVE-2023-50383

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Three os command injection vulnerabilities exist in the boa formWsc functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted series of HTTP requests can lead to arbitrary command execution. An attacker can send a series of HTTP requests to trigger these vulnerabilities.This command injection is related to the `localPin` request's parameter.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
LevelOne	WBR-6013	RER4_A_v3411b_2T2R_LEV_09_170623
Realtek	rtl819x Jungle SDK	v3.4.11
realtek	rtl819x_software_development_kit	3.4.11
level_one	wbr6013	rer4_a_v3411b_2t2r_lev_09_170623

References

https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899Third Party Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1899Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1899

Timeline

Published: Jul 8, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-503868.8Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Unt CVE-2023-503877.5Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of ser CVE-2023-503958.0SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability require CVE-2023-50418.8The Track The Click WordPress plugin before 0.3.12 does not properly sanitize query parameters to the stats REST endpoint before using them CVE-2023-50427.5Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office CVE-2023-504229.8SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from CVE-2023-504239.8SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privi CVE-2023-504249.8SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain co CVE-2023-504285.3In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as cod CVE-2023-504299.1IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.CVE-2023-50438.8Ingress nginx annotation injection causes arbitrary command execution.CVE-2023-504306.4The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when e