What is CVE-2023-43477?

CVE-2023-43477 is a medium-severity vulnerability in Telstra Arcadyan Lh1000, classified under Command Injection. CVSS score: 6.8/10. Published 2023-09-20.

How severe is CVE-2023-43477?

Medium severity. CVSS v3 base score is 6.8 out of 10.

RCE in Telstra Arcadyan Lh1000

CVE-2023-43477

The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.157 (96.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

CWE-77 — Command Injection

References

vulnreport@tenable.com (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2023-43477?: CVE-2023-43477 is a medium-severity vulnerability in Telstra Arcadyan Lh1000, classified under Command Injection. CVSS score: 6.8/10. Published 2023-09-20.
How severe is CVE-2023-43477?: Medium severity. CVSS v3 base score is 6.8 out of 10.