OS Command Injection Vulnerability in Emagic Data Center Management Suite
CVE-2023-37569

8.8HIGH

Key Information:

Vendor

Esds

Status
Emagic Data Center Management Suite
Vendor
CVE Published:
8 August 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 33%

What is CVE-2023-37569?

A security gap in the ESDS Emagic Data Center Management Suite arises from inadequate input sanitization in its Ping component. This flaw enables a remote authenticated attacker to exploit the vulnerability by injecting operating system commands. If successfully executed, this would grant the attacker the ability to run arbitrary code on the affected system, leading to potential system compromise and unauthorized actions.

Affected Version(s)

Emagic Data Center Management Suite 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-37569
Created by piecar21

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
http://packetstormsecurity.com/files/174084/Emagic-Data-C...

EPSS Score

33% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shubham Pandey of C3i Center, IIT Kanpur
Lohitya Pushkar of C3i Center, IIT Kanpur
Chinamay Joshi of ESDS Software Solution Limited, Maharashtra
.