CVE-2023-43477

🗓️ 20 Sep 2023 12:41:03Reported by tenableType

The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, leading to command injection as root on the device

Reporter	Title	Published	Views	Family All 8
Circl	CVE-2023-43477	2 Oct 202311:03	–	circl
CNNVD	Telstra Smart Modem Command Injection Vulnerability	20 Sep 202300:00	–	cnnvd
Cvelist	CVE-2023-43477 Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)	20 Sep 202312:41	–	cvelist
NVD	CVE-2023-43477	20 Sep 202313:15	–	nvd
OSV	CVE-2023-43477	20 Sep 202313:15	–	osv
Prion	Command injection	20 Sep 202313:15	–	prion
RedhatCVE	CVE-2023-43477	23 May 202505:25	–	redhatcve
Vulnrichment	CVE-2023-43477 Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)	20 Sep 202312:41	–	vulnrichment

NVD

Node

telstra arcadyan_lh1000_firmwareRange<0.18.15r

AND

telstra arcadyan_lh1000Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "Smart Modem Gen 2 (Arcadyan LH1000)",
    "vendor": "Telstra",
    "versions": [
      {
        "lessThan": "0.18.15r",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2023-19

21 Nov 2024 08:24Current

7.3High risk

Vulners AI Score7.3

CVSS 3.16.8 - 8.8

EPSS0.20768

SSVC

CWE-77