CVE-2023-43744
Description
An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an administrator to execute arbitrary OS commands via a file name parameter in a patch application function. The Zultys MX Administrator client has a "Patch Manager" section that allows administrators to apply patches to the device. The user supplied filename for the patch file is passed to a shell script without validation. Including bash command substitution characters in a patch file name results in execution of the provided command.
How to fix
- zultys mx-se_firmware16.0.4, 17.0.10 or later
- zultys mx-se_ii_firmware16.0.4, 17.0.10 or later
- zultys mx-e_firmware16.0.4, 17.0.10 or later
- zultys mx-virtual_firmware16.0.4, 17.0.10 or later
- zultys mx250_firmware16.0.4, 17.0.10 or later
- zultys mx30_firmware16.0.4, 17.0.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zultys mx-se_firmware | v < 16.0.4, 17.0.6 ≤ v < 17.0.10 | 16.0.4, 17.0.10 |
| zultys mx-se_ii_firmware | v < 16.0.4, 17.0.6 ≤ v < 17.0.10 | 16.0.4, 17.0.10 |
| zultys mx-e_firmware | v < 16.0.4, 17.0.6 ≤ v < 17.0.10 | 16.0.4, 17.0.10 |
| zultys mx-virtual_firmware | v < 16.0.4, 17.0.6 ≤ v < 17.0.10 | 16.0.4, 17.0.10 |
| zultys mx250_firmware | v < 16.0.4, 17.0.6 ≤ v < 17.0.10 | 16.0.4, 17.0.10 |
| zultys mx30_firmware | v < 16.0.4, 17.0.6 ≤ v < 17.0.10 | 16.0.4, 17.0.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.