CVE-2023-49254
High
Description
Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however, it can still be exploited by sending POST requests directly.
SeverityHigh
CVSS8.8
Exploit probability—
ProductHongdian H8951-4g-esp Firmware
PublishedJan 12, 2024
First seenJan 12, 2024
Weakness typeCWE-78OS command injection
How to fix
Update
- hongdian h8951-4g-esp_firmware2310271149 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hongdian h8951-4g-esp_firmware | v < 2310271149 | 2310271149 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.