CVE-2023-2588

HIGH Year: 2023
CVSS v3 Score
8.8
High
Weakness Type
CWE-830
View all →

Vulnerability Description

Teltonika’s Remote Management System versions prior to 4.10.0 have a feature allowing users to access managed devices’ local secure shell (SSH)/web management services over the cloud proxy. A user can request a web proxy and obtain a URL in the Remote Management System cloud subdomain. This URL could be shared with others without Remote Management System authentication . An attacker could exploit this vulnerability to create a malicious webpage that uses a trusted and certified domain. An attacker could initiate a reverse shell when a victim connects to the malicious webpage, achieving remote code execution on the victim device.

Related Vulnerabilities

CVE-2024-29944

HIGH
CVSS:8.4(High)

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, i...

CWE-8302024

CVE-2024-42381

HIGH
CVSS:8.3(High)

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp sectio...

CWE-8302024

CVE-2025-33026

HIGH
CVSS:7.8(High)

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. U...

CWE-8302025

CVE-2025-33027

HIGH
CVSS:7.8(High)

In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of...

CWE-8302025

CVE-2024-29944

HIGH
CVSS:8.4(High)

An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent process. Note: This vulnerability affects Desktop Firefox only, i...

CWE-8302024

CVE-2024-42381

HIGH
CVSS:8.3(High)

os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows attackers to achieve code execution via an ELF file with a custom .interp sectio...

CWE-8302024