CVE-2023-0830
EasyNAS backup.pl system os command injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Feb 14, 2023
- Updated
- May 1, 2025
- Reserved
- Feb 14, 2023
Description
A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
EasyNASn/a |
|
References
- VDB-220950 | EasyNAS backup.pl system os command injectionvdb-entrytechnical-description
- VDB-220950 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #86683 | EasyNAS 1.1.0 - Authenticated OS Command Injectionthird-party-advisory
- https://github.com/xbz0n/CVE-2023-0830exploit
- https://www.exploit-db.com/exploits/51266exploit
- https://gist.github.com/xbz0n/674af0e802efaaafe90d2f67464c2690exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.