CVE-2023-22855 is a critical remote code execution (RCE) vulnerability affecting Kardex Mlog MCC version 5.7.12+0-a203c2a213-master. It stems from improper sanitization of a user-controlled path, allowing local or remote file inclusion via the web interface on port 8088. If a .t4 file is provided, the mono/t4 templating engine can execute arbitrary code. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. The EPSS score is high, indicating a significant likelihood of exploitation. While not listed in CISA's KEV catalog, an exploit (EDB-51239) is publicly available on ExploitDB, and there is substantial community discussion surrounding this CVE. There is no indication of active exploitation in the wild, and no Metasploit or Nuclei modules are currently available.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
5.7.12\+0-a203c2a213-masterCPE matchmatch criteria | cpe:2.3:a:kardex:kardex_control_center:5.7.12\+0-a203c2a213-master:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.