CVE-2023-38027

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38027
SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:myspotcam:sense_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:myspotcam:sense:-:*:*:*:*:*:*:*
History

21 Nov 2024, 08:12

Type Values Removed Values Added
References () https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html - Third Party Advisory () https://www.twcert.org.tw/tw/cp-132-7334-351fb-1.html - Third Party Advisory

14 Oct 2024, 04:15

Type Values Removed Values Added
Summary
  • (es) La función oculta Telnet de SpotCam Sense de SpotCam Co. Ltd. tiene una vulnerabilidad de inyección de comandos del sistema operativo. Un atacante remoto no autenticado puede explotar esta vulnerabilidad para ejecutar un ataque de inyección de comandos para ejecutar comandos arbitrarios del sistema o interrumpir el servicio.
Summary (en) SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service. (en) SpotCam Co., Ltd. SpotCam Sense’s hidden Telnet function has a vulnerability of OS command injection. An remote unauthenticated attacker can exploit this vulnerability to execute command injection attack to perform arbitrary system commands or disrupt service.
CWE CWE-78
Information

Published : 2023-08-28 04:15

Updated : 2024-11-21 08:12

NVD link : CVE-2023-38027

Mitre link : CVE-2023-38027

CVE.ORG link : CVE-2023-38027

JSON object : View

Products Affected

myspotcam

  • sense_firmware
  • sense
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')