by Kastro
Paper/Archive/CVE-2023-38378

CVE-2023-38378

rigol mso5000 — The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary cod…

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 73.8.738 × 2014.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.

Affected

ProductAffectedFixed inSource
n/an/a–CNA
mso500000.01.03.00.03–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

reftortel.li/post/insecure-scoperefnews.ycombinator.com/item?id=36745664