Vulnerability · Published May 4, 2023 · Assigned by VulDB

CVE-2023-2522Chengdu VEC40G Network Detection os command injection

Medium 4.7

In plain English

A medium-severity OS command injection in VEC40G from Chengdu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 33.7% (higher than 98% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)33.7%top 1.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=access_detect of the component Network Detection. The manipulation of the argument COUNT with the input 3 | netstat -an leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228013 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Chengdu	VEC40G	3.0

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.228013 vdb-entry, technical-description
https://vuldb.com/?ctiid.228013 signature, permissions-required
https://github.com/eckert-lcc/cve/blob/main/Flying%20fish%20star.md exploit