CVE-2023-28129

HIGH

DSM <2022.2 SU2 - Command Injection

Title source: llm

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user.

Core 1

Core References

Vendor Advisory

CVSS v3 7.8

EPSS 0.0053

EPSS Percentile 67.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Status published

Products (2)

ivanti/desktop_\&_server_management 2022.2 (3 CPE variants)

ivanti/desktop_\&_server_management < 2022.2

Published Aug 10, 2023

Tracked Since Feb 18, 2026