CVE-2023-26609
Published: 27 February 2023
Summary
CVE-2023-26609 is a high-severity an unspecified weakness vulnerability in Abus Tvip 20000-21150 Firmware. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 2.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
ABUS TVIP 20000-21150 devices contain a remote code execution vulnerability that stems from improper handling of shell metacharacters in the ap parameter of the /cgi-bin/mft/wireless_mft endpoint. The flaw received a CVSS 3.1 base score of 7.2 and is tracked without an assigned CWE.
Remote attackers who possess high-privileged credentials can supply crafted input to the affected CGI field and obtain arbitrary command execution on the device. Successful exploitation grants full read, write, and disruption capabilities over the target system.
Public exploit code and technical details have been published on Packet Storm and the Full Disclosure mailing list, accompanied by an advisory at nwsec.de. The associated EPSS score has remained near 0.37 with only a negligible peak-to-current difference and shows no material post-disclosure climb.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-30404
Vulnerability details
ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.