CVE-2023-34216CWE-22

Second Order Command-injection Vulnerability in the Key-delete Function

High · published August 17, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could potentially allow malicious users to delete arbitrary files.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00712 · 53.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-08-17T06:41Z
EPSS history
Timeline
  • 17 AUG 06:41Z
    Second Order Command-injection Vulnerability in the Key-delete Function
    cvelistv5