CVE-2023-6260

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Brivo ACS100, ACS300 allows OS Command Injection, Bypassing Physical Security.This issue affects ACS100 (Network Adjacent Access), ACS300 (Physical Access): from 5.2.4 before 6.2.4.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Brivo	ACS100, ACS300	>= 5.2.4, < 6.2.4.3
brivo	acs100_firmware	>= 5.2.4, < 6.2.4.3
brivo	acs300_firmware	>= 5.2.4, < 6.2.4.3

References

https://sra.io/advisories/Third Party Advisory
https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#brivo_firmware_release_6_2_4_3Release Notes
https://sra.io/advisories/Third Party Advisory
https://support.brivo.com/l/en/article/g82txdwepa-brivo-firmware-release-notes#brivo_firmware_release_6_2_4_3Release Notes

Timeline

Published: Feb 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-62638.1An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by us CVE-2023-62645.3Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configure CVE-2023-62658.1** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpS CVE-2023-62667.5The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the B CVE-2023-62679.8A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may co CVE-2023-62686.1The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page CVE-2023-62699.8An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session B CVE-2023-62707.0A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on CVE-2023-62717.5The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which CVE-2023-62729.8The Theme My Login 2FA WordPress plugin before 1.2 does not rate limit 2FA validation attempts, which may allow an attacker to brute-force a CVE-2023-62735.3Permission management vulnerability in the module for disabling Sound Booster. Successful exploitation of this vulnerability may cause featu CVE-2023-62749.8A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknown