PT-2023-27116 · N.V.K.Inter Co. · Ibsg

CVE-2023-39809 · Publicado 2023-08-21 · Atualizado 2024-10-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions N.V.K.INTER CO., LTD. (NVK) iBSG version 3.5

Description A command injection issue was discovered, affecting the system hostname parameter at the "/manage/network-basic.php" API endpoint. This allows for potential command injection attacks.

Recommendations For version 3.5, consider restricting access to the /manage/network-basic.php API endpoint until a patch is available. As a temporary workaround, avoid using the system hostname parameter in this endpoint to minimize the risk of exploitation.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-39809

Produtos afetados

Ibsg

Referências · 8

• https://sec.maride.cc/posts/ibsg · Nota
• http://ibsg.com · Nota
• http://nvkinter.com · Nota
• https://t.me/cvenotify/56956 · Publicação no Telegram
• https://t.me/cvenotify/96982 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39809 · Aviso do Fabricante
• https://github.com/maride · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39809 · Nota de Segurança