CVE-2023-43744 Command injection in n/a
Administrators can execute arbitrary OS commands via unsanitized filename input in the patch application function of Zultys VoIP systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-43744?
CVE-2023-43744 is a high-severity command injection vulnerability in n/a, published on 8 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an administrator to execute arbitrary OS commands via a file name parameter in a patch application function. The Zultys MX Administrator client has a "Patch Manager" section that allows administrators to apply patches to the device. The user supplied filename for the patch file is passed to a shell script without validation. Including bash command substitution characters in a patch file name results in execution of the provided command.
Weakness: CWE-78
Which versions are affected by CVE-2023-43744?
It affects 6 products.
Products include Zultys Mx-E Firmware, Zultys Mx-Se Firmware, Zultys Mx-Se Ii Firmware, Zultys Mx-Virtual Firmware, Zultys Mx250 Firmware, Zultys Mx30 Firmware.
How do I fix CVE-2023-43744?
No fix has been published for CVE-2023-43744 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-43744 being exploited?
There is no known exploitation of CVE-2023-43744 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cx8g-cw67-m22j.