CVE-2023-26802

Deeper analysis

CVE-2023-26802 is a critical authentication-bypass vulnerability in the /network_config/nsg_masq.cgi component of DCN DCBI-Netlog-LAB version 1.0. The flaw, assigned CWE-22, permits remote attackers to submit specially crafted requests that circumvent authentication checks and execute arbitrary operating-system commands. It carries a CVSS 3.1 base score of 9.8, reflecting network-accessible, low-complexity exploitation with no required credentials or user interaction and full impact on confidentiality, integrity, and availability.

Unauthenticated attackers on the network can leverage the issue to gain complete control of affected appliances, enabling them to read or modify configuration data, install persistent backdoors, or pivot into connected network segments. Because the vulnerable endpoint is reachable without prior authentication, exploitation can occur from any internet-facing or internally accessible management interface.

Public proof-of-concept material has been published in GitHub repositories, and the CVE’s EPSS score has reached a peak of 0.8591 with a current value of 0.7799, indicating sustained exploitation interest since disclosure. No vendor advisory or official patch information is referenced in the available sources.