CVE-2023-4120 is a critical command injection vulnerability affecting the Byzoro Smart S85F Management Platform, specifically within the importhtml.php file when processing the 'sql' argument. This flaw allows for remote, unauthenticated attackers to execute arbitrary commands. The vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. Its high EPSS score and FAUCET Risk Score indicate a significant likelihood of exploitation. While not yet added to the CISA KEV catalog, public exploit details have been disclosed, and there is substantial community discussion surrounding this CVE, suggesting active interest in its exploitation. There are currently no known Metasploit or Nuclei modules, nor an ExploitDB entry.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 20230722CPE matchmatch criteria | cpe:2.3:a:byzoro:smart_s85f:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.