CVE-2023-38378

EUVD-2023-42195
The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
Affected Products (NVD)
VendorProductVersion
rigolmso5000_firmware
00.01.03.00.03
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://news.ycombinator.com/item?id=36745664
https://tortel.li/post/insecure-scope/
https://news.ycombinator.com/item?id=36745664
https://tortel.li/post/insecure-scope/