PT-2025-42220 · Bytevalue · Bytevalue Intelligent Flow Control Router

Published 2025-10-15 · Updated 2025-10-15 · CVE-2023-7311

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions BYTEVALUE Intelligent Flow Control Router (affected versions not specified)

Description The BYTEVALUE Intelligent Flow Control Router contains a command injection issue through the /goform/webRead/open API endpoint. The path parameter lacks proper validation and is echoed into a shell context, enabling an attacker to inject and execute arbitrary shell commands. Successful exploitation could result in the installation of backdoors, privilege escalation, and complete compromise of the router and its management functions. The Rondo botnet has been observed targeting this issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-7311

Affected Products

Bytevalue Intelligent Flow Control Router

References · 10

• 🔥 https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/web/bytevalue_goform_webread_open_rce.yaml · Exploit
• 🔥 https://isc.sans.edu/diary/Exploit+against+Unnamed+Bytevalue+router+vulnerability+included+in+Mirai+Bot/30642 · Exploit
• 🔥 https://blog.csdn.net/zkaqlaoniao/article/details/134328873 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7311 · Security Note
• https://vulncheck.com/advisories/bytevalue-intelligent-flow-control-router-command-injection · Note
• https://twitter.com/VulmonFeeds/status/1978345906928861214 · Twitter Post
• https://twitter.com/CveFindCom/status/1978282017776152781 · Twitter Post
• https://t.me/cveNotify/138778 · Telegram Post
• https://twitter.com/CVEnew/status/1978562109244903474 · Twitter Post
• https://t.me/CVEtracker/34931 · Telegram Post