Actively exploited · Published Oct 26, 2023 · Assigned by mitre
CVE-2023-43208
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity OS command injection in Mirth Connect from NextGen Healthcare. Attackers are actively exploiting it in the wild (listed by CISA on May 20, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 85.9% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 10, 2024.
Official description
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.
Affected products (as reported)
Weakness: CWE-78, CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H