CVE-2023-6320criticalCWE-78

CVE-2023-6320: falha crítica em LG webOS

Command injection in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar webOS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 4.0%
A command injection vulnerability exists in the com.webos.service.connectionmanager/tv/setVlanStaticAddress endpoint on webOS versions 5 and 6. A series of specially crafted requests can lead to command execution as the dbus user. An attacker can make authenticated requests to trigger this vulnerability. Full versions and TV models affected: * webOS 5.5.0 - 04.50.51 running on OLED55CXPUA  * webOS 6.3.3-442 (kisscurl-kinglake) - 03.36.50 running on OLED48C1PUB
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
LG · webOS
CVEs relacionadas — LG webOS

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6319CRITICALCommand injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceEPSS 6.4%CVE-2023-6318CRITICALCommand injection in the processAnalyticsReport method from the com.webos.service.cloudupload serviceEPSS 4.7%