CVE-2023-34217CWE-22

Second Order Command-injection Vulnerability in the Certificate-delete Function

High · published August 17, 2023

CVSS v3.1
8.1
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which could potentially allow malicious users to delete arbitrary files.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-08-17T06:48Z
EPSS history
Timeline
  • 17 AUG 06:48Z
    Second Order Command-injection Vulnerability in the Certificate-delete Function
    cvelistv5