CVE-2023-33377

Published Aug 4, 2023

Last updated a year ago

CVSS critical 9.8

Overview

Description: Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:connectedio:connected_io:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AF690623-7129-4811-9897-90ECE1F8DFDA",
            "versionEndIncluding": "2.1.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References