CVE-2023-1685

Deeper analysis

A command injection vulnerability has been identified in HadSky versions up to 7.11.8, specifically within the unknown code of the file /install/index.php that belongs to the Installation Interface component. The issue, tracked as CVE-2023-1685 and assigned CWE-77, arises from improper handling of input that allows command execution. It carries a CVSS 3.1 score of 6.3 reflecting network attack vector, low complexity, and low privileges required.

An attacker with low-privileged remote access can trigger the flaw to inject and execute arbitrary commands on the affected system, resulting in limited impacts to confidentiality, integrity, and availability. Public exploit code has already been disclosed, enabling potential reuse by threat actors.

The provided references consist primarily of technical write-ups and proof-of-concept disclosures on platforms such as Gitee and VulDB, without detailing vendor patches or official mitigation steps. The associated EPSS score has remained low and stable near 0.058 with only minimal fluctuation from its recorded peak.