CVE-2023-33376

Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://claroty.com/team82/disclosure-dashboard/cve-2023-33376	Third Party Advisory
https://www.connectedio.com/products/routers	Product

Configurations

Configuration 1 (hide)

cpe:2.3:a:connectedio:connected_io:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-04 18:15

Updated : 2023-08-08 19:51

NVD link : CVE-2023-33376

Mitre link : CVE-2023-33376

CVE.ORG link : CVE-2023-33376

JSON object : View

Products Affected

connectedio

connected_io

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2023-33376", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-08-04T18:15:12.503", "references": [{"url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-33376", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.connectedio.com/products/routers", "tags": ["Product"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices."}, {"lang": "es", "value": "Connected IO v2.1.0 y anteriores tiene una vulnerabilidad de inyecci\u00f3n de argumentos en su mensaje de comando iptables en su protocolo de comunicaci\u00f3n, lo que permite a los atacantes ejecutar comandos arbitrarios del sistema operativo en los dispositivos.\n"}], "lastModified": "2023-08-08T19:51:32.797", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:connectedio:connected_io:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF690623-7129-4811-9897-90ECE1F8DFDA", "versionEndIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

9.8 /10