CVE-2023-49900 -- CVSS 9.8 Vulnerability Briefing

CVE-2023-49900 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2023-49900 is a critical unauthenticated remote code execution vulnerability affecting a product that processes a SetParameter command, where insufficient input sanitization allows arbitrary code execution without any prior authentication.

Technical Detail

The flaw resides in the handling of user-supplied input within the SetParameter command, which fails to properly sanitize data before processing it, enabling an attacker to inject and execute arbitrary code on the target system. Exploitation requires no credentials and can be triggered remotely, placing this in the highest-risk category for network-exposed deployments. Successful exploitation grants the attacker code execution in the context of the vulnerable service, which may lead to full system compromise depending on the privilege level of the running process.

Exploitation Status

No known exploit has been publicly documented or observed as of this writing. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. While the CVSS score of 9.8 reflects the theoretical severity of the flaw, there is currently no confirmed proof-of-concept code, operational exploit, or evidence of active exploitation in the wild.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with this vulnerability in available intelligence sources.

What To Do

Apply vendor-supplied patches as soon as they become available, treating this as a high-priority remediation given the unauthenticated RCE nature of the flaw and its CVSS 9.8 score. Until patching is complete, restrict network access to any service or interface that exposes the SetParameter command, using firewall rules or network segmentation to limit exposure to trusted hosts only. Monitor for anomalous command execution or unexpected process spawning originating from the affected service as a detection signal. Confirm with the relevant vendor whether a patch or firmware update is available, as specific product details have not been publicly enumerated in the CVE record at this time.