CVE-2023-0648
Published: 02 February 2023
Summary
CVE-2023-0648 is a medium-severity Command Injection (CWE-77) vulnerability in Dst-Admin Project Dst-Admin. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 8.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-0648 is a command injection vulnerability in dst-admin version 1.5.0, specifically in the /home/masterConsole component. The issue stems from improper handling of the command argument and is tracked under CWE-77, with a CVSS 3.1 score of 6.3 reflecting network-accessible attack conditions.
An authenticated remote attacker with low privileges can supply crafted input to the affected endpoint and achieve limited execution of operating system commands, resulting in partial impacts to confidentiality, integrity, and availability. Publicly available exploit details confirm the attack requires no user interaction and can be launched over the network.
The associated EPSS score has remained flat at 0.0626 with no material rise after disclosure. Reference materials consist of vulnerability database entries and a public GitHub repository containing proof-of-concept code, but contain no details on official patches or mitigation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-12682
Vulnerability details
A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate the attack remotely. The…
more
exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-220035.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.