CVE-2023-5683
Published: 21 October 2023
Summary
CVE-2023-5683 is a medium-severity OS Command Injection (CWE-78) vulnerability in Byzoro Smart S85F Firmware. Its CVSS base score is 6.3 (Medium).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A vulnerability classified as an OS command injection issue (CWE-78) affects the Byzoro Smart S85F Management Platform through version 20231010. The flaw resides in the file /sysmanage/importconf.php, where manipulation of the btn_file_renew argument permits arbitrary command execution. It carries a CVSS 3.1 score of 6.3 and was publicly disclosed under VDB-243059 after the vendor failed to respond to early notification.
An authenticated remote attacker with low privileges can trigger the flaw over the network without user interaction, resulting in limited impacts to confidentiality, integrity, and availability. Public exploit code has been released, enabling potential unauthorized command execution on the affected management platform.
No vendor patches or official mitigation guidance have been issued. The associated EPSS score remains flat at 0.1785 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57974
Vulnerability details
A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack…
more
may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.