Cyber Resilience

CVE-2023-45599

Ailux Imx6 ≤ 1.0.7-2

Published
05 March 2024
Modified
03 March 2025
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
EPSS Score 0.0022 12th percentile
Risk Priority 37 floored blend · peak EPSS

Summary

CVE-2023-45599 is a medium-severity Reliance on File Name or Extension of Externally-Supplied File (CWE-646) vulnerability in Ailux Imx6. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Double File Extension (T1036.007); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web application allows a remote authenticated attacker to upload any arbitrary type of file into the device. This issue affects: AiLux imx6…

more

bundle below version imx6_1.0.7-2.

CWE(s)
CWE-646CWE-434

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036.007 Double File Extension Stealth
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
attack.mitre.org →
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1036.002 Right-to-Left Override Stealth
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.
attack.mitre.org →
T1036.006 Space after Filename Stealth
Adversaries can hide a program's true filetype by changing the extension of a file.
attack.mitre.org →
T1036.008 Masquerade File Type Stealth
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-45595Same product: Ailux Imx6
CVE-2023-45593Same product: Ailux Imx6
CVE-2023-45598Same product: Ailux Imx6
CVE-2023-45596Same product: Ailux Imx6
CVE-2023-45592Same product: Ailux Imx6
CVE-2023-45591Same product: Ailux Imx6
CVE-2023-5457Same product: Ailux Imx6
CVE-2023-5456Same product: Ailux Imx6
CVE-2023-45594Same product: Ailux Imx6
CVE-2023-45597Same product: Ailux Imx6

Affected Assets

ailux
imx6
≤ 1.0.7-2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V5.1.1

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Requires validation of information inputs, which structurally stops reliance on untrusted file names or extensions by forcing content-based checks.

SI-3 Malicious Code Protection good match

Malicious-code protection at entry points blocks dangerous file types from being accepted and executed.

CM-7 Least Functionality partial match

Least functionality restricts the file types and automatic processing capabilities the system will accept.

SC-18 Mobile Code partial match

Mobile-code controls define, authorize, and block unacceptable uploaded code before automatic processing occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-05 mostly match
prevents

Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require content-based validation instead of trusting file extensions for externally supplied files.

PR.PS-01 partial match
prevents

Hardened configuration baselines can enforce allowed file types and processing rules.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect the weakness, but the control does not guarantee its elimination.

A.8.19 Installation of software on operational systems partial match
degrades

Restricting software installation can limit dangerous file types but does not enforce content-based validation.

A.8.23 Web filtering partial match
degrades

Web filtering can block risky file extensions but does not address server-side file handling logic.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC requires proper file-type validation, directly mitigating reliance on untrusted names or extensions.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate content inspection, but the control itself does not prescribe the technique.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage safe file handling, yet the control is broader than this specific weakness.

References