CVE-2023-7311
Gravedad CVSS v4.0:
CRÍTICA
Tipo:
CWE-78
Neutralización incorrecta de elementos especiales usados en un comando de sistema operativo (Inyección de comando de sistema operativo)
Fecha de publicación:
15/10/2025
Última modificación:
16/10/2025
Descripción
*** Pendiente de traducción *** BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The `path` parameter is not properly validated and is echoed into a shell context, allowing an attacker to inject and execute arbitrary shell commands on the device. Successful exploitation can lead to writing backdoors, privilege escalation on the host, and full compromise of the router and its management functions. VulnCheck has observed this vulnerability being targeted by the RondoDox botnet campaign.
Impacto
Puntuación base 4.0
9.30
Gravedad 4.0
CRÍTICA
Referencias a soluciones, herramientas e información
- https://blog.csdn.net/zkaqlaoniao/article/details/134328873
- https://github.com/adysec/nuclei_poc/blob/49c283b2bbb244c071786a2b768fbdde1b91f38e/poc/web/bytevalue_goform_webread_open_rce.yaml
- https://isc.sans.edu/diary/Exploit+against+Unnamed+Bytevalue+router+vulnerability+included+in+Mirai+Bot/30642
- https://www.vulncheck.com/advisories/bytevalue-intelligent-flow-control-router-command-injection