RCE in Rigol Mso5000
CVE-2023-38378
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.015 (71.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Rigol Mso5000
- Rigol Mso5000_firmware — versions 00.01.03.00.03
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory)
- cve@mitre.org (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2023-38378?
- CVE-2023-38378 is a critical-severity vulnerability in Rigol Mso5000, classified under OS Command Injection. CVSS score: 9.8/10. Published 2023-07-16.
- How severe is CVE-2023-38378?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-38378 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.