CVE-2023-36622

HIGH

Loxone Miniserver Go Gen.2 <14.1.5.9 - Command Injection

Title source: llm
STIX 2.1

Description

The websocket configuration endpoint of the Loxone Miniserver Go Gen.2 before 14.1.5.9 allows remote authenticated administrators to inject arbitrary OS commands via the timezone parameter.

References (2)

Core 2

Scores

CVSS v3 7.2
EPSS 0.0102
EPSS Percentile 59.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
loxone/miniserver_go_gen_2_firmware < 14.1.5.9
Published Jul 05, 2023
Tracked Since Feb 18, 2026