CVE-2023-43208 NextGen Healthcare Mirth Connect Deserialization of Untrusted Data

Exploited in the wild Critical 9.8 Published 26 Oct 2023 Updated 21 Oct 2025

Unauthenticated attackers can execute arbitrary code on NextGen Healthcare Mirth Connect servers due to incomplete patching of a previous vulnerability.

Exploited in the wild: Since 20 May 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-43208?

CVE-2023-43208 is a critical command injection vulnerability in n/a, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.

Weakness: CWE-78, CWE-502

Which versions are affected by CVE-2023-43208?

It affects 1 product.

Products include Nextgen Mirth Connect.

How do I fix CVE-2023-43208?

No fix has been published for CVE-2023-43208 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Jun 2024.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-43208 being exploited?

Yes. Attackers have exploited CVE-2023-43208 in the wild since at least 20 May 2024, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 13 proofs of concept on GitHub.

CVE-2023-37679 Command injection in n/a Critical 9.8

Sources

Also known as GHSA-pj5c-qr29-6746.