CVE-2023-6318criticalCWE-78

CVE-2023-6318: falha crítica em LG webOS

Command injection in the processAnalyticsReport method from the com.webos.service.cloudupload service

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar webOS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 4.7%
A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA  * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB  * webOS 7.3.1-43 (mullet-mebin) - 03.33.85 running on OLED55A23LA
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
LG · webOS
CVEs relacionadas — LG webOS

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6319CRITICALCommand injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceEPSS 6.4%CVE-2023-6320CRITICALCommand injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpointEPSS 4.0%