CVE-2023-38523 Information disclosure in n/a
Unauthenticated attackers can access sensitive command history and screenshots via directory listing on Samsung AMX N-Series devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-38523?
CVE-2023-38523 is a medium-severity vulnerability in n/a, published on 20 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, exposing sensitive information such as the command history and screenshot of the file being processed. This affects N-Series N1115 Wallplate Video Encoder before 1.15.61, N-Series N1x22A Video Encoder/Decoder before 1.15.61, N-Series N1x33A Video Encoder/Decoder before 1.15.61, N-Series N1x33 Video Encoder/Decoder before 1.15.61, N-Series N2x35 Video Encoder/Decoder before 1.15.61, N-Series N2x35A Video Encoder/Decoder before 1.15.61, N-Series N2xx2 Video Encoder/Decoder before 1.15.61, N-Series N2xx2A Video Encoder/Decoder before 1.15.61, N-Series N3000 Video Encoder/Decoder before 2.12.105, and N-Series N4321 Audio Transceiver before 1.00.06.
Weakness: CWE-306
Which versions are affected by CVE-2023-38523?
It affects 33 products.
Products include Samsung Fgn1115-Wp-Wh Firmware, Samsung Fgn1122-Cd Firmware, Samsung Fgn1122-Sa Firmware, Samsung Fgn1133-Cd Firmware, Samsung Fgn1133-Sa Firmware, Samsung Fgn1133a-Cd Firmware and 27 more.
How do I fix CVE-2023-38523?
No fix has been published for CVE-2023-38523 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-38523 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-38523 exists.
Sources
Also known as GHSA-5m5m-q46w-3jpx.