CVE-2023-33377

CRITICAL

Connected IO <2.1.0 - Command Injection

Title source: llm
STIX 2.1

Description

Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0150
EPSS Percentile 71.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
connectedio/connected_io < 2.1.0
Published Aug 04, 2023
Tracked Since Feb 18, 2026