CVE-2023-44857

Published: Apr 12, 2024Modified: May 27, 2025

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in Cobham SAILOR VSAT Ku v.164B019, allows a remote attacker to execute arbitrary code via a crafted script to the sub_21D24 function in the acu_web component.

Affected (2)

Products: Cobham: Sailor 600 Vsat Ku Firmware

Cobham

1 product

Sailor 600 Vsat Ku Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cobham Sailor 600 Vsat Ku Firmware	Version 164_build019

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Cobham Sailor 600 Vsat Ku Firmware	Version 164b019

Running on/with	Platform Versions
Cobham Sailor 600 Vsat Ku	All versions

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://pine-amphibian-9b9.notion.site/SAILOR-Ku-Software-RCE-and-Privilege-Escalation-Statistics-report-b8e953249468429d9f60b89ff653847a

Source: cve@mitre.org

ExploitThird Party Advisory

https://pine-amphibian-9b9.notion.site/SAILOR-Ku-Software-RCE-and-Privilege-Escalation-Statistics-report-b8e953249468429d9f60b89ff653847a

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.