Vulnerability · Published Jan 23, 2024 · Assigned by mitre
CVE-2023-36177
Critical 9.8
In plain English
A critical-severity code injection in the snapcast package (Debian). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 27.5% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)27.5%top 1.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | snapcast | 0.26.0+dfsg1-1+deb12u1 | DEBIAN-CVE-2023-36177 |
| Debian:12 | snapcast | 0.26.0+dfsg1-1+deb12u1 | DSA-5847-1 |
| Debian:13 | snapcast | 0.30.0-1 | DEBIAN-CVE-2023-36177 |
| Debian:14 | snapcast | 0.30.0-1 | DEBIAN-CVE-2023-36177 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H