CVE-2023-45593

Published: Mar 5, 2024Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

Affected (1)

Products: Ailux: Imx6

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ailux Imx6	Before 1.0.7-2

Related CWEs

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (2)

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593

Source: prodsec@nozominetworks.com

Third Party Advisory

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2023-45593

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.