CVE-2023-0830CWE-77CWE-78

EasyNAS backup.pl system os command injection

Medium · published February 14, 2023

CVSS v4.0

5.3

EPSS

21%

Percentile

97.5

In the wild

Unconfirmed

What it is

A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

The record

Technical detail

CVSS v4.0: 5.3 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS: 0.20862 · 97.5th percentile
Weaknesses: CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection'); CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2023-02-14T16:13Z

EPSS history

Timeline

14 FEB 16:13Z
EasyNAS backup.pl system os command injection
cvelistv5