CVE-2023-37469 HIGH

CVE-2023-37469: CasaOS Command Injection vulnerability

Vendor Icewhaletech

Product CasaOS

Weakness CWE-77

Published August 24, 2023

Last update October 2, 2024

View on NVD All CVEs

CVSS base score

8.8/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

Key dates

02Disclosure timeline

August 24, 2023 CVE published

October 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-37469 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2025-5139 Qualitor Office 365-type Connection testaConexaoOffice365.php command injection CVE-2019-17101 Command execution due to unsanitized input in Netatmo Smart Indoor Security Camera CVE-2023-4414 Byzoro Smart S85F Management Platform decodmail.php command injection CVE-2019-1624 Cisco SD-WAN Solution Command Injection Vulnerability CVE-2025-5146 Netcore NBR200V2 HTTP Header routerd passwd_set command injection