{"cve":"CVE-2023-27917","nvd":{"published":"2023-04-11T09:15:08.200","modified":"2026-06-17T05:46:06.540","status":"Modified","description":"OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network Maintenance page to execute arbitrary OS commands with a root privilege. The affected products and versions are as follows: M2M Gateway with the firmware Ver.3.7.10 and earlier (CPS-MG341-ADSC1-111, CPS-MG341-ADSC1-931, CPS-MG341G-ADSC1-111, CPS-MG341G-ADSC1-930, and CPS-MG341G5-ADSC1-931), M2M Controller Integrated Type with firmware Ver.3.7.6 and earlier versions (CPS-MC341-ADSC1-111, CPS-MC341-ADSC1-931, CPS-MC341-ADSC2-111, CPS-MC341G-ADSC1-110, CPS-MC341Q-ADSC1-111, CPS-MC341-DS1-111, CPS-MC341-DS11-111, CPS-MC341-DS2-911, and CPS-MC341-A1-111), and M2M Controller Configurable Type with firmware Ver.3.8.8 and earlier versions (CPS-MCS341-DS1-111, CPS-MCS341-DS1-131, CPS-MCS341G-DS1-130, CPS-MCS341G5-DS1-130, and CPS-MCS341Q-DS1-131).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-78"],"references":["https://jvn.jp/en/vu/JVNVU96198617/","https://www.contec.com/api/downloadlogger?download=/-/media/Contec/jp/support/security-info/contec_security_cps_230317_en.pdf","https://www.contec.com/download/donwload-list/?itemid=a054b3eb-da97-40d0-9598-d7f5ff4239ec#firmware","https://www.contec.com/download/donwload-list/?itemid=a1b33f0d-d32b-4549-9741-613cd37d5528#firmware","https://www.contec.com/download/donwload-list/?itemid=f832c526-dcf6-4976-85aa-f536c15a8120#firmware"],"products":["contec:cps-mc341-a1-111_firmware","contec:cps-mc341-adsc1-111_firmware","contec:cps-mc341-adsc1-931_firmware","contec:cps-mc341-adsc2-111_firmware","contec:cps-mc341-ds1-111_firmware","contec:cps-mc341-ds11-111_firmware","contec:cps-mc341-ds2-911_firmware","contec:cps-mc341g-adsc1-110_firmware","contec:cps-mc341q-adsc1-111_firmware","contec:cps-mcs341-ds1-111_firmware","contec:cps-mcs341-ds1-131_firmware","contec:cps-mcs341g-ds1-130_firmware","contec:cps-mcs341g5-ds1-130_firmware","contec:cps-mcs341q-ds1-131_firmware","contec:cps-mg341-adsc1-111_firmware","contec:cps-mg341-adsc1-931_firmware","contec:cps-mg341g-adsc1-111_firmware","contec:cps-mg341g-adsc1-930_firmware","contec:cps-mg341g5-adsc1-931_firmware"],"source":"nvd","synced_at":"2026-10-19T21:38:05.473481323+00:00"},"epss":{"cve":"CVE-2023-27917","score":0.01929,"percentile":0.79996,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}