CVE-2023-7311

🗓️ 15 Oct 2025 01:19:38Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 27 Views🌐 WEB

Router has command injection via /goform/webRead/open; unvalidated path echoes to shell.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-7311	16 Oct 202521:02	–	circl
CNNVD	BESTWOND Intelligent Flow Control Router 安全漏洞	15 Oct 202500:00	–	cnnvd
Cvelist	CVE-2023-7311 BYTEVALUE Intelligent Flow Control Router Command Injection	15 Oct 202501:19	–	cvelist
EUVD	EUVD-2023-59994	15 Oct 202501:19	–	euvd
NVD	CVE-2023-7311	15 Oct 202502:15	–	nvd
Positive Technologies	PT-2025-42220	15 Oct 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2023-7311: Improper Neutralization of Special Elements used in an OS Command	15 Oct 202500:00	–	rapid7
RedhatCVE	CVE-2023-7311	16 Oct 202501:41	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2023-7311	12 Feb 202400:00	–	vulncheck_kev
Vulnrichment	CVE-2023-7311 BYTEVALUE Intelligent Flow Control Router Command Injection	15 Oct 202501:19	–	vulnrichment

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/goform/webRead/open (path parameter)"
    ],
    "product": "Flow Control Router",
    "vendor": "BYTEVALUE (Luoyang Baiwei Intelligent Technology Co., Ltd.)",
    "versions": [
      {
        "status": "affected",
        "version": "*"
      }
    ]
  }
]

Source	Link
isc	www.isc.sans.edu/diary/Exploit+against+Unnamed+Bytevalue+router+vulnerability+included+in+Mirai+Bot/30642
vulncheck	www.vulncheck.com/advisories/bytevalue-intelligent-flow-control-router-command-injection
blog	www.blog.csdn.net/zkaqlaoniao/article/details/134328873
github	www.github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/web/bytevalue_goform_webread_open_rce.yaml

Parameter	Position	Path	Description	CWE
path	path	/goform/webRead/open	Command injection via path parameter echoed into shell context in /goform/webRead/open (CVE-2023-7311).	CWE-78

17 Jun 2026 06:52Current

8.1High risk

Vulners AI Score8.1

CVSS 49.3

EPSS0.01858

SSVC