9.8

CVE-2023-30764

OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kbdevice ≫ Kb-ahr04d Firmware Version < 91110.1.101106.78
   Kbdevice ≫ Kb-ahr04d Version-
Kbdevice ≫ Kb-ahr08d Firmware Version < 91210.1.101106.78
   Kbdevice ≫ Kb-ahr08d Version-
Kbdevice ≫ Kb-ahr16d Firmware Version < 91310.1.101106.78
   Kbdevice ≫ Kb-ahr16d Version-
Kbdevice ≫ Kb-irip04a Firmware Version < 95110.1.100290.78a
   Kbdevice ≫ Kb-irip04a Version-
Kbdevice ≫ Kb-irip08a Firmware Version < 95210.1.100290.78a
   Kbdevice ≫ Kb-irip08a Version-
Kbdevice ≫ Kb-irip16a Firmware Version < 95310.1.100290.78a
   Kbdevice ≫ Kb-irip16a Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.73% 0.819
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.