What is the severity of CVE-2023-22280?

The severity of CVE-2023-22280 is high with a CVSS score of 7.2.

How can an attacker exploit CVE-2023-22280?

An attacker with an administrative privilege can exploit CVE-2023-22280 by executing arbitrary OS commands remotely.

How can I fix CVE-2023-22280?

To fix CVE-2023-22280, upgrade to Ver.1.11.00 or a later version of MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud, MAHO-PBX NetDevancer VSG Lite/Uni, or MAHO-PBX NetDevancer MobileGate Home/Office.

Vulnerability/
CVE-2023-22280

high

7.2

CWE

17/1/2023

24/1/2023

CVE-2023-22280: OS Command Injection

Q: What is CVE-2023-22280?

CVE-2023-22280 is a vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud and MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00 and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 that allows a remote authenticated attacker with administrative privilege to execute arbitrary OS commands.

Q: How does CVE-2023-22280 affect the affected software?

CVE-2023-22280 affects MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00.

First published: Tue Jan 17 2023(Updated: )

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.

Credit: vultures@jpcert.or.jp

Affected Software	Affected Version	How to fix
Ate-mahoroba Maho-pbx Netdevancer Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer
Ate-mahoroba Maho-pbx Netdevancer Vsg Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer Vsg
Ate-mahoroba Maho-pbx Netdevancer Mobilegate Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer Mobilegate
Ate-mahoroba Maho-pbx Netdevancer Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer
Ate-mahoroba Maho-pbx Netdevancer Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer
Ate-mahoroba Maho-pbx Netdevancer Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer
Ate-mahoroba Maho-pbx Netdevancer Vsg Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer Vsg
Ate-mahoroba Maho-pbx Netdevancer Mobilegate Firmware	<1.11.00
Ate-mahoroba Maho-pbx Netdevancer Mobilegate

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2023-22280?
CVE-2023-22280 is a vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud and MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00 and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 that allows a remote authenticated attacker with administrative privilege to execute arbitrary OS commands.
What is the severity of CVE-2023-22280?
The severity of CVE-2023-22280 is high with a CVSS score of 7.2.
How does CVE-2023-22280 affect the affected software?
CVE-2023-22280 affects MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00.
How can an attacker exploit CVE-2023-22280?
An attacker with an administrative privilege can exploit CVE-2023-22280 by executing arbitrary OS commands remotely.
How can I fix CVE-2023-22280?
To fix CVE-2023-22280, upgrade to Ver.1.11.00 or a later version of MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud, MAHO-PBX NetDevancer VSG Lite/Uni, or MAHO-PBX NetDevancer MobileGate Home/Office.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.