CVE-2023-26802: dcnglobal dcbi-netlog-lab

Record summary

CVE-2023-26802 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Feb 1, 2023 · VulnCheck
Reported exploitation: Observed · VulnCheck

Available material

Nuclei templates: 1

CISA SSVC decision

ExploitationPoC

AutomatableYes

Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 23, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
dcbi-netlog-lab_firmware Browse dcnglobal / dcbi-netlog-lab_firmware	VulnCheck	Version data not supplied

Nuclei templates

ProjectDiscoveryCRITICALDCBI-Netlog-LAB v1.0 - Command InjectionCVSS 9.8

Impact

Unauthenticated attackers can bypass authentication and execute arbitrary OS commands on the DCN DCBI-Netlog-LAB device, leading to complete device compromise and potential network infiltration.

Remediation

Upgrade to the latest firmware version from DCN that addresses this command injection vulnerability, or apply vendor-provided security patches.

WeaknessesCWE-22

Authorspussycat0x

Template tagscvecve2023rceunauthnetlogvkevvuln

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE: cpe:2.3:o:dcnglobal:dcbi-netlog-lab_firmware:1.0:*:*:*:*:*:*:*

https://web.archive.org/web/20230605051153/https://github.com/winmt/my-vuls/tree/main/DCN%20DCBI-Netlog-LAB

Source: ProjectDiscovery

References

github.com

https://github.com/winmt/my-vuls/tree/main/DCN%20DCBI-Netlog-LAB

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2023-26802