CVE-2023-40144

Deeper analysis

CVE-2023-40144 is an OS command injection vulnerability, tracked under CWE-78, that affects certain CBC-branded products including Digimaster and Pixelmaster lines. The flaw permits execution of arbitrary operating-system commands or modification of device settings; the vendor lists specific affected versions while noting that the NR4H, NR8H, NR16H, DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, and DR-4M41 series are end-of-life and receive no updates.

A remote attacker who already possesses valid credentials can exploit the issue over the network without user interaction, obtaining high-impact effects on confidentiality, integrity, and availability of the target device. The CVSS 3.1 base score of 8.8 reflects this authenticated but otherwise low-complexity attack path.

Vendor advisories published on ganzsecurity.com and coordinated through JVN recommend applying the fixes referenced in the security notices for supported models; unsupported products have no remediation path available. The associated EPSS score reached a peak of 0.1013 before receding to its current value of 0.0809, indicating modest and non-persistent external interest after disclosure.