CVE-2023-49254
Command injection in the network test tools
- State
- Published
- Severity
- 8.8 High
- Published
- Jan 12, 2024
- Updated
- Jun 20, 2025
- Reserved
- Nov 24, 2023
Description
Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however, it can still be exploited by sending POST requests directly.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
H8951-4G-ESPHongdian |
|
References
- https://cert.pl/en/posts/2024/01/CVE-2023-49253/third-party-advisory
- https://cert.pl/posts/2024/01/CVE-2023-49253/third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.