Vulnerability · Published Oct 16, 2023 · Assigned by GovTech CSG
CVE-2023-3991OS command injection vulnerability in FreshTomato 2023.3
Critical 10.0
In plain English
A critical-severity OS command injection in FreshTomato from FreshTomato. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)10.0Critical
Exploit odds (30 days)2.1%top 18.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| FreshTomato | FreshTomato | 2023.3 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H