CVE-2023-26213

Katalog CVE

CVSS 7.2 · High EPSS 7,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada barracuda t100b firmware, barracuda t200c firmware +5 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.

Rincian

Terbit di NVD

3 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

7,9% peluang dieksploitasi; lebih tinggi dari 94,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://seclists.org/fulldisclosure/2023/Mar/2 exploit · mailing list · advisory pihak ketiga
• https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/ exploit · advisory pihak ketiga
• https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/ release notes
• https://www.barracuda.com/products/network-security/cloudgen-wan product