high7.2
CVE-2023-36622
The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS comman…
Impact
The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Loxone | Miniserver Go Gen 2 Firmware | before 14.1.5.9 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-012.txt
- https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-miniserver-go-gen-2-syss-2023-004/-012/-013
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-012.txt
- https://www.syss.de/pentest-blog/root-zugang-zu-smarthome-server-loxone-miniserver-go-gen-2-syss-2023-004/-012/-013