CVE-2023-2682 is a critical command injection vulnerability affecting Caton Live versions up to 2023-04-26. It allows remote attackers to execute arbitrary commands by manipulating the 'address' argument in the /cgi-bin/ping.cgi component, specifically through the Mini_HTTPD service. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a high-impact threat with no user interaction required and full confidentiality, integrity, and availability compromise. Despite its severity, there is no known public exploit code (Metasploit, Nuclei, ExploitDB), nor is it listed in CISA's KEV catalog. Community discussion and media coverage are minimal, suggesting low public awareness at this time.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2023-04-26CPE matchmatch criteria | cpe:2.3:a:catontechnology:caton_live:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.