CVE-2023-43477
Medium
Description
The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device.
SeverityMedium
CVSS6.8
Exploit probability—
ProductTelstra Arcadyan Lh1000 Firmware
PublishedSep 20, 2023
First seenSep 20, 2023
Weakness typeCWE-77Command injection
How to fix
Update
- telstra arcadyan_lh1000_firmware0.18.15r or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| telstra arcadyan_lh1000_firmware | v < 0.18.15r | 0.18.15r |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.