CVE-2023-26602: Command Injection
Published Feb 26, 2023
·Updated
ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.
Credit
ub3rsick
Affected Software
1 affected component
ASUS Asmb8-ikvm Firmware<=1.14.51
Event History
Feb 26, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Jun 1, 2024
Exploit Published
via ExploitDB·12:00 AM
Known Exploited
via ExploitDB·12:00 AM
Apr 16, 2025
Exploit Published
12:00 AM
Frequently Asked Questions
1
What is the severity of CVE-2023-26602?
The severity of CVE-2023-26602 is critical with a CVSS score of 9.8.
2
How does CVE-2023-26602 allow remote attackers to execute arbitrary code?
CVE-2023-26602 allows remote attackers to execute arbitrary code by using SNMP to create extensions, specifically through the snmpset command.
3
Which ASUS ASMB8 iKVM firmware versions are affected by CVE-2023-26602?
ASUS ASMB8 iKVM firmware version 1.14.51 is affected by CVE-2023-26602.
4
Are there any known fixes or patches for CVE-2023-26602?
No known fixes or patches are available for CVE-2023-26602 at this time.
5
What is the Common Weakness Enumeration (CWE) number for CVE-2023-26602?
The CWE number for CVE-2023-26602 is CWE-77.