← Back

CVE-2023-26213

nvd nist
Published: Mar 3, 2023Modified: Mar 7, 2025

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters.

Affected (7)

Barracuda
7 products
T100b Firmware
T200c Firmware
T400c Firmware
T600d Firmware
T900b Firmware
T93a Firmware
T193a Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T100b Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T100b
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T200c Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T200c
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T400c Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T400c
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T600d Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T600d
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T900b Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T900b
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T93a Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T93a
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
T193a Firmware
Version 8.3.1
Running on/withPlatform Versions
Barracuda
T193a
All versions

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (8)

Source: cve@mitre.org
ExploitMailing ListThird Party Advisory
Source: cve@mitre.org
Release Notes
Source: cve@mitre.org
ExploitThird Party Advisory
Source: cve@mitre.org
Product
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product

Timeline

No history available yet.