CVE-2023-38378

2023-07-1600:00:00

mitre

www.cve.org

web interface

remote attackers

arbitrary code

shell metacharacters

webcontrol changepwd.cgi

pass1

firmware

cve-2023-38378

AI Score

9.9

Confidence

High

EPSS

0.008

Percentile

81.5%

JSON

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.

References

news.ycombinator.com/item?id=36745664

tortel.li/post/insecure-scope/