What is CVE-2023-33374?

CVE-2023-33374 is a critical-severity vulnerability in Connectedio Connected Io, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-08-04.

How severe is CVE-2023-33374?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Connectedio Connected Io

CVE-2023-33374

Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.013 (68.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Connectedio Connected_io
N/a — versions n/a

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cve@mitre.org (Product)
cve@mitre.org (Third Party Advisory)

Frequently asked questions

What is CVE-2023-33374?: CVE-2023-33374 is a critical-severity vulnerability in Connectedio Connected Io, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-08-04.
How severe is CVE-2023-33374?: Critical severity. CVSS v3 base score is 9.8 out of 10.