Lucene search

NCSC-NLCVELIST:CVE-2023-41917

HistoryJul 02, 2024 - 7:41 a.m.

CVE-2023-41917 Improper input validation in Kiloview P1/P2 devices allows for remote code execution

2024-07-0207:41:28

CWE-20

NCSC-NL

www.cve.org

kiloview p1

kiloview p2

input validation

remote code execution

rce

vulnerability

speed-measurement

unauthorized code execution

shell commands

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.2%

JSON

Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution.

CNA Affected

[
  {
    "vendor": "Kiloview",
    "product": "P1/P2",
    "versions": [
      {
        "status": "affected",
        "version": "All",
        "lessThanOrEqual": "4.8.2605",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "affected"
  }
]

References

advisories.ncsc.nl/advisory?id=NCSC-2024-0273

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

9.2%

JSON

Related for CVELIST:CVE-2023-41917