« Volver al listado

CVE-2023-34999

Estado: ModificadaAlta (7.2)—

A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Bosch — RTS Vlink Virtual Matrix

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-34999",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-34999",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-25T15:35:34.761711Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@bosch.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.7
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@bosch.com",
      "affectedData": [
        {
          "vendor": "RTS",
          "product": "VLink Virtual Matrix Software",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.7.6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.0.0",
              "lessThan": "6.5.0",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows"
          ]
        }
      ]
    }
  ],
  "published": "2023-09-18T11:15:41.867",
  "references": [
    {
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-893251-BT.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@bosch.com"
    },
    {
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-893251-BT.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@bosch.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface."
    },
    {
      "lang": "es",
      "value": " Existe una vulnerabilidad de inyección de comandos en RTS VLink Virtual Matrix Software versiones v5 (&lt; 5.7.6) y v6 (&lt; 6.5.0) que permite a un atacante realizar la ejecución de código arbitrario a través de la interfaz web de administración."
    }
  ],
  "lastModified": "2026-06-17T06:04:15.060",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bosch:rts_vlink_virtual_matrix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB340A4E-132C-46A5-8A80-B1A4C45A2CE8",
              "versionEndExcluding": "5.7.6",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:bosch:rts_vlink_virtual_matrix:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6A940F1-AF61-43F8-BABA-2E14EAD2E0D4",
              "versionEndExcluding": "6.5.0",
              "versionStartIncluding": "6.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@bosch.com"
}