by Kastro
Paper/Archive/CVE-2023-3991

CVE-2023-3991

FreshTomato FreshTomato — OS command injection vulnerability in FreshTomato 2023.3

EPSS 2%CVSS 10.0
critical.is priorityof 100
46
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 82.0.820 × 2016.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An OS command injection vulnerability exists in the httpd iperfrun.cgi functionality of FreshTomato 2023.3. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.

Affected

ProductAffectedFixed inSource
FreshTomato2023.3–CNA

Scores by source

GovTech CSG (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgovtech-csg.github.io/security-advisories/2023/10/16/CVE-2023-3991.html