PT-2023-27116 · N.V.K.Inter Co. · Ibsg

CVE-2023-39809 · Published 2023-08-21 · Updated 2024-10-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions N.V.K.INTER CO., LTD. (NVK) iBSG version 3.5

Description A command injection issue was discovered, affecting the system hostname parameter at the "/manage/network-basic.php" API endpoint. This allows for potential command injection attacks.

Recommendations For version 3.5, consider restricting access to the /manage/network-basic.php API endpoint until a patch is available. As a temporary workaround, avoid using the system hostname parameter in this endpoint to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-39809

Affected Products

Ibsg

References · 8

• https://osv.dev/vulnerability/CVE-2023-39809 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39809 · Security Note
• https://sec.maride.cc/posts/ibsg · Note
• http://ibsg.com · Note
• http://nvkinter.com · Note
• https://t.me/cvenotify/56956 · Telegram Post
• https://t.me/cvenotify/96982 · Telegram Post
• https://github.com/maride · Note