Description
A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.
References (2)
Core 2
Core References
Product
https://kratosdefense.com
Scores
CVSS v3
9.8
EPSS
0.0127
EPSS Percentile
66.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
kratosdefense/ngc_indoor_unit_firmware
9.1.0.4
Published
Jul 18, 2023
Tracked Since
Feb 18, 2026