CVE-2023-26213

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-26213", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-03-07T15:55:49.918Z", "dateReserved": "2023-02-20T00:00:00.000Z", "datePublished": "2023-03-03T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-03-03T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.barracuda.com/products/network-security/cloudgen-wan"}, {"name": "20230302 SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN", "tags": ["mailing-list"], "url": "http://seclists.org/fulldisclosure/2023/Mar/2"}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/"}, {"url": "https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.292Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.barracuda.com/products/network-security/cloudgen-wan", "tags": ["x_transferred"]}, {"name": "20230302 SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN", "tags": ["mailing-list", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2023/Mar/2"}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/", "tags": ["x_transferred"]}, {"url": "https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-07T15:54:30.667962Z", "id": "CVE-2023-26213", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-07T15:55:49.918Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.barracuda.com/products/network-security/cloudgen-wan", "tags": ["x_transferred"]}, {"url": "http://seclists.org/fulldisclosure/2023/Mar/2", "name": "20230302 SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN", "tags": ["mailing-list", "x_transferred"]}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/", "tags": ["x_transferred"]}, {"url": "https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:46:23.292Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-26213", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-07T15:54:30.667962Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-07T15:55:06.942Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.barracuda.com/products/network-security/cloudgen-wan"}, {"url": "http://seclists.org/fulldisclosure/2023/Mar/2", "name": "20230302 SEC Consult SA-20230228-0 :: OS Command Injectionin Barracuda CloudGen WAN", "tags": ["mailing-list"]}, {"url": "https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/"}, {"url": "https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/"}], "descriptions": [{"lang": "en", "value": "On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-03-03T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26213", "state": "PUBLISHED", "dateUpdated": "2025-03-07T15:55:49.918Z", "dateReserved": "2023-02-20T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-03-03T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t100b_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "396AC132-60C1-4148-A751-5EB8CD95666F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t100b:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF643D7C-722D-4756-A170-B9B6CF8C3368", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t200c_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "5165FF77-16A9-43E9-9F50-16F15858620D", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t200c:-:*:*:*:*:*:*:*", "matchCriteriaId": "1A7A1511-0858-40EA-869D-AD212B30BDF2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t400c_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "95DA502F-971B-4F29-B41C-6AF16BAA3AF3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t400c:-:*:*:*:*:*:*:*", "matchCriteriaId": "2DA2099D-D1E5-4F3B-A207-3E1A886E911D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t600d_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "46C4BE5C-2F6F-44AE-A337-9D85C7FFCC17", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t600d:-:*:*:*:*:*:*:*", "matchCriteriaId": "B0915A13-9562-4299-B7F0-F8FDD4B813D2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t900b_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "EFF3DFD7-57B7-4926-B146-8EF396E78DB2", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t900b:-:*:*:*:*:*:*:*", "matchCriteriaId": "4321174A-F14C-490C-9B92-850FBAA7EABE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t93a_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "7D833BB2-70BC-4EEC-8EEF-332E3CEE7387", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t93a:-:*:*:*:*:*:*:*", "matchCriteriaId": "90093740-56A6-4E49-BFFC-5039CDE95877", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:barracuda:t193a_firmware:8.3.1:-:*:*:*:*:*:*", "matchCriteriaId": "202C1DB3-9EDC-4560-AE26-62E0667AFA41", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:barracuda:t193a:-:*:*:*:*:*:*:*", "matchCriteriaId": "DDE8BBEB-FDA3-4616-A79E-989AD852F221", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exists in /ajax/update_certificate - a crafted HTTP request allows an authenticated attacker to execute arbitrary commands. For example, a name field can contain :password and a password field can contain shell metacharacters."}], "id": "CVE-2023-26213", "lastModified": "2026-06-17T05:42:50.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-26213", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-07T15:54:30.667962Z", "version": "2.0.3"}}]}, "published": "2023-03-03T22:15:09.840", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Mar/2"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.barracuda.com/products/network-security/cloudgen-wan"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2023/Mar/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://campus.barracuda.com/product/cloudgenwan/doc/96024723/release-notes-8-3-1/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://sec-consult.com/vulnerability-lab/advisory/os-command-injection-in-barracuda-cloudgen-wan/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://www.barracuda.com/products/network-security/cloudgen-wan"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}