Sign-up

ID

VAR-202302-2072


CVE

CVE-2023-26602


TITLE

ASUSTeK Computer Inc.  of  ASMB8-iKVM  Command injection vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2023-004643

DESCRIPTION

ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution. ASUSTeK Computer Inc. of ASMB8-iKVM Firmware contains a command injection vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2023-26602 // JVNDB: JVNDB-2023-004643 // VULHUB: VHN-456033 // VULMON: CVE-2023-26602

AFFECTED PRODUCTS

vendor:asusmodel:asmb8-ikvmscope:lteversion:1.14.51

Trust: 1.0

vendor:asustek computermodel:asmb8-ikvmscope:eqversion: -

Trust: 0.8

vendor:asustek computermodel:asmb8-ikvmscope: - version: -

Trust: 0.8

vendor:asustek computermodel:asmb8-ikvmscope:lteversion:asmb8-ikvm firmware 1.14.51 and earlier

Trust: 0.8

sources: JVNDB: JVNDB-2023-004643 // NVD: CVE-2023-26602

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2023-26602
value: CRITICAL

Trust: 1.0

NVD: CVE-2023-26602
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202302-2049
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2023-26602
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2023-26602
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2023-004643 // CNNVD: CNNVD-202302-2049 // NVD: CVE-2023-26602

PROBLEMTYPE DATA

problemtype:CWE-77

Trust: 1.1

problemtype:Command injection (CWE-77) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-456033 // JVNDB: JVNDB-2023-004643 // NVD: CVE-2023-26602

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202302-2049

TYPE

command injection

Trust: 0.6

sources: CNNVD: CNNVD-202302-2049

EXPLOIT AVAILABILITY

sources:
            
            
            VULHUB: VHN-456033

EXTERNAL IDS
db:NVDid:CVE-2023-26602
Trust: 3.4
db:PACKETSTORMid:171137
Trust: 2.6
db:JVNDBid:JVNDB-2023-004643
Trust: 0.8
db:CXSECURITYid:WLB-2023020047
Trust: 0.6
db:CNNVDid:CNNVD-202302-2049
Trust: 0.6
db:VULHUBid:VHN-456033
Trust: 0.1
db:VULMONid:CVE-2023-26602
Trust: 0.1
sources:
            
            
            VULHUB: VHN-456033 // 
            
            
            
            VULMON: CVE-2023-26602 // 
            
            
            
            JVNDB: JVNDB-2023-004643 // 
            
            
            
            CNNVD: CNNVD-202302-2049 // 
            
            
            
            NVD: CVE-2023-26602

REFERENCES
url:http://packetstormsecurity.com/files/171137/asus-asmb8-ikvm-1.14.51-snmp-remote-root.html
Trust: 2.7
url:http://seclists.org/fulldisclosure/2023/feb/15
Trust: 2.6
url:https://nwsec.de/nwssa-002-2023.txt
Trust: 2.6
url:https://nvd.nist.gov/vuln/detail/cve-2023-26602
Trust: 0.8
url:https://cxsecurity.com/issue/wlb-2023020047
Trust: 0.6
url:https://cxsecurity.com/cveshow/cve-2023-26602/
Trust: 0.6
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-456033 // 
            
            
            
            VULMON: CVE-2023-26602 // 
            
            
            
            JVNDB: JVNDB-2023-004643 // 
            
            
            
            CNNVD: CNNVD-202302-2049 // 
            
            
            
            NVD: CVE-2023-26602

CREDITS
d1g
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202302-2049

SOURCES
db:VULHUBid:VHN-456033
db:VULMONid:CVE-2023-26602
db:JVNDBid:JVNDB-2023-004643
db:CNNVDid:CNNVD-202302-2049
db:NVDid:CVE-2023-26602

LAST UPDATE DATE
2024-08-14T13:52:42.231000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-456033date:2023-03-07T00:00:00
db:VULMONid:CVE-2023-26602date:2023-02-28T00:00:00
db:JVNDBid:JVNDB-2023-004643date:2023-11-01T01:39:00
db:CNNVDid:CNNVD-202302-2049date:2023-03-08T00:00:00
db:NVDid:CVE-2023-26602date:2023-03-07T19:07:11.717

SOURCES RELEASE DATE
db:VULHUBid:VHN-456033date:2023-02-26T00:00:00
db:VULMONid:CVE-2023-26602date:2023-02-26T00:00:00
db:JVNDBid:JVNDB-2023-004643date:2023-11-01T00:00:00
db:CNNVDid:CNNVD-202302-2049date:2023-02-26T00:00:00
db:NVDid:CVE-2023-26602date:2023-02-26T20:15:10.697