CVE-2023-23551CWE-94

X-600M Code Injection

Critical · published February 13, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
59.3
In the wild
Unconfirmed
What it is

🚨 A crafty code injection flaw in Control By Web X-600M devices could let attackers execute any command they want! 🔥 Think of it like a remote-controlled car that can be hijacked to speed off in any direction at the press of a button — an unauthorized user could drive your system where they please! If exploited, this vulnerability could allow an attacker to remotely execute arbitrary code, wreaking havoc on your devices and potentially compromising your entire network. Imagine hackers gaining full control, altering configurations, or even launching further attacks from your unsuspecting devices. Yikes!

Put simply

Think of it like a remote-controlled car that can be hijacked to speed off in any direction at the press of a button — an unauthorized user could drive your system where they please! This critical code injection vulnerability allows attackers to run malicious Lua scripts on Control By Web X-600M devices. By manipulating input, an attacker can execute arbitrary code, gaining access to the device's functions.

What to do

If exploited, this vulnerability could allow an attacker to remotely execute arbitrary code, wreaking havoc on your devices and potentially compromising your entire network. Imagine hackers gaining full control, altering configurations, or even launching further attacks from your unsuspecting devices. Yikes! Immediately update your Control By Web X-600M devices to the latest firmware version that addresses this vulnerability. Additionally, review your network security settings to ensure only trusted devices can connect. Regularly audit your scripts and monitor for unusual activity! You've got this! Stay vigilant, follow these steps, and you'll be on your way to securing your devices in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00898 · 59.3th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-02-13T17:02Z
EPSS history
Timeline
  • 13 FEB 17:02Z
    X-600M Code Injection
    cvelistv5