CVE-2023-22280 Command injection in MAHO-PBX NetDevancer series
Remote authenticated administrators can execute arbitrary OS commands on MAHO-PBX NetDevancer systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-22280?
CVE-2023-22280 is a high-severity command injection vulnerability in Mahoroba Kobo, Inc. MAHO-PBX NetDevancer series, published on 17 Jan 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.
Weakness: CWE-78
Which versions are affected by CVE-2023-22280?
It affects 3 products.
Products include Ate-Mahoroba Maho-Pbx Netdevancer Firmware, Ate-Mahoroba Maho-Pbx Netdevancer Mobilegate Firmware, Ate-Mahoroba Maho-Pbx Netdevancer Vsg Firmware.
How do I fix CVE-2023-22280?
No fix has been published for CVE-2023-22280 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-22280 being exploited?
There is no known exploitation of CVE-2023-22280 in the wild and no public exploit code.
Other vulnerabilities in Mahoroba Kobo, Inc. MAHO-PBX NetDevancer series
Sources
Also known as GHSA-mcm8-gg2j-q8vh.