Zultys MX-SE/MX-SE II/MX-E/MX-Virtual/MX250/MX30 prior 16.04 Patch 16109/17.0.10 Patch 17161 Patch Application File os command injection

Summaryinfo

A vulnerability marked as critical has been reported in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250 and MX30. Affected by this issue is some unknown functionality of the component Patch Application Handler. This manipulation of the argument File causes os command injection. This vulnerability is tracked as CVE-2023-43744. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250 and MX30. It has been declared as critical. Affected by this vulnerability is an unknown code of the component Patch Application Handler. The manipulation of the argument file with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an administrator to execute arbitrary OS commands via a file name parameter in a patch application function. The Zultys MX Administrator client has a "Patch Manager" section that allows administrators to apply patches to the device. The user supplied filename for the patch file is passed to a shell script without validation. Including bash command substitution characters in a patch file name results in execution of the provided command.

The weakness was disclosed 12/08/2023 as ATREDIS-2023-0002. The advisory is shared at github.com. This vulnerability is known as CVE-2023-43744 since 09/22/2023. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Upgrading to version 16.04 Patch 16109 or 17.0.10 Patch 17161 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Zultys

Name

• MX-E
• MX-SE
• MX-SE II
• MX-Virtual
• MX30
• MX250

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion