CVE-2023-5142

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
H3C	GR-1100-P	20230908
H3C	GR-1108-P	20230908
H3C	GR-1200W	20230908
H3C	GR-1800AX	20230908
H3C	GR-2200	20230908
H3C	GR-3200	20230908
H3C	GR-5200	20230908
H3C	GR-8300	20230908
H3C	ER2100n	20230908
H3C	ER2200G2	20230908
H3C	ER3200G2	20230908
H3C	ER3260G2	20230908
H3C	ER5100G2	20230908
H3C	ER5200G2	20230908
H3C	ER6300G2	20230908

References

https://github.com/CJCniubi666/H3C-ER/blob/main/README.mdExploit, Third Party Advisory
https://github.com/yinsel/CVE-H3C-ReportExploit, Third Party Advisory
https://vuldb.com/?ctiid.240238Permissions Required, Third Party Advisory
https://vuldb.com/?id.240238Third Party Advisory
https://github.com/CJCniubi666/H3C-ER/blob/main/README.mdExploit, Third Party Advisory
https://github.com/yinsel/CVE-H3C-ReportExploit, Third Party Advisory
https://vuldb.com/?ctiid.240238Permissions Required, Third Party Advisory
https://vuldb.com/?id.240238Third Party Advisory

Timeline

Published: Sep 24, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-514208.8Improper Control of Generation of Code ('Code Injection') vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affect CVE-2023-514218.8Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce.This issue affects Verge3D CVE-2023-514228.8Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream CVE-2023-514239.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder Team Webinar Plugin: Creat CVE-2023-514249.8Improper Privilege Management vulnerability in Saleswonder Team WebinarIgnition allows Privilege Escalation.This issue affects WebinarIgniti CVE-2023-514259.8Improper Privilege Management vulnerability in Jacques Malgrange Rencontre – Dating Site allows Privilege Escalation.This issue affects Renc CVE-2023-514267.1Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-514277.1Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-514287.1Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.CVE-2023-514295.5Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.CVE-2023-51439.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DAR-7000 up to 20151231. This is CVE-2023-514305.5Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.