CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2023-40144
High (8.8) in cbc. EPSS 2.1% chance of exploitation in the next 30 days.
OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- cbc:dr-16f42a_firmware
- cbc:dr-16f45at_firmware
- cbc:dr-16h_firmware
- cbc:dr-16m52-av_firmware
- cbc:dr-16m52_firmware
- cbc:dr-4fx1_firmware
- cbc:dr-4h_firmware
- cbc:dr-4m51-av_firmware
- cbc:dr-8f42a_firmware
- cbc:dr-8f45at_firmware
- cbc:dr-8h_firmware
- cbc:dr-8m52-av_firmware
- cbc:drh8-4m41-a_firmware
- cbc:nr-16f82-16p_firmware
- cbc:nr-16f85-8pra_firmware
- cbc:nr-16m_firmware
- cbc:nr-4f_firmware
- cbc:nr-8f_firmware
- cbc:nr16h_firmware
- cbc:nr4h_firmware
- cbc:nr8-4m71_firmware
- cbc:nr8-8m72_firmware
- cbc:nr8h_firmware