Cyber Resilience

CVE-2023-4873

MediumPublic PoC

Published: 10 September 2023

Published
10 September 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0515 90.1th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-4873 is a medium-severity OS Command Injection (CWE-78) vulnerability in Byzoro Smart S45F Firmware. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A vulnerability classified as OS command injection was identified in the Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to version 20230906. The flaw resides in an unknown function within the /importexport.php file, where manipulation of the sql argument allows arbitrary command execution and is tracked as CWE-78 with the identifier VDB-239358.

An attacker with low-privileged remote access can supply crafted input to the affected parameter and execute operating system commands on the target device, resulting in partial impacts to confidentiality, integrity, and availability. The issue carries a CVSS 3.1 score of 6.3 and an exploit that has already been published publicly.

The associated EPSS score reached a peak of 0.0702 with a current value of 0.0515; references point to public disclosure of proof-of-concept code but contain no vendor advisory or patch details.

EU & UK References

Vulnerability details

A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os…

more

command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1202 Indirect Command Execution Stealth
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
attack.mitre.org →
Why these techniques?

CVE-2023-4873 is an OS command injection vulnerability in a public-facing web application (/importexport.php), enabling exploitation of public-facing applications (T1190) and indirect command execution via unsanitized input to shell commands (T1202), as explicitly mapped by VulDB.

Affected Assets

byzoro
smart s45f firmware
≤ 20230906

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References