Lucene search

PRIOn knowledge basePRION:CVE-2023-28381

HistoryOct 11, 2023 - 4:15 p.m.

Command injection

2023-10-1116:15:00

PRIOn knowledge base

www.prio-n.com

vulnerability

command injection

peplink surf soho hw1

mvpn_trial_init

http request

authentication

nvd

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.7%

JSON

An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU). A specially crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

CPENameOperatorVersion
surf_soho_firmwareeq6.3.5

CPE	Name	Operator	Version
	surf_soho_firmware	eq	6.3.5

References

talosintelligence.com/vulnerability_reports/TALOS-2023-1779