Cyber Resilience

CVE-2023-5683

MediumPublic PoC

Published: 21 October 2023

Published
21 October 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.1785 95.3th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-5683 is a medium-severity OS Command Injection (CWE-78) vulnerability in Byzoro Smart S85F Firmware. Its CVSS base score is 6.3 (Medium).

Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

A vulnerability classified as an OS command injection issue (CWE-78) affects the Byzoro Smart S85F Management Platform through version 20231010. The flaw resides in the file /sysmanage/importconf.php, where manipulation of the btn_file_renew argument permits arbitrary command execution. It carries a CVSS 3.1 score of 6.3 and was publicly disclosed under VDB-243059 after the vendor failed to respond to early notification.

An authenticated remote attacker with low privileges can trigger the flaw over the network without user interaction, resulting in limited impacts to confidentiality, integrity, and availability. Public exploit code has been released, enabling potential unauthorized command execution on the affected management platform.

No vendor patches or official mitigation guidance have been issued. The associated EPSS score remains flat at 0.1785 with no material increase observed since disclosure.

EU & UK References

Vulnerability details

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231010 and classified as critical. This issue affects some unknown processing of the file /sysmanage/importconf.php. The manipulation of the argument btn_file_renew leads to os command injection. The attack…

more

may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-243059. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

byzoro
smart s85f firmware
≤ 2023-10-10

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References