CVE-2023-43478

HIGH EXPLOITED IN THE WILD

Telstra Smart Modem Gen 2 - RCE

Title source: llm

Description

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root.

References (1)

Core 1

Core References

Exploit, Third Party Advisory

https://www.tenable.com/security/research/tra-2023-19

Scores

CVSS v3 8.8

EPSS 0.0413

EPSS Percentile 88.7%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact total

Details

VulnCheck KEV 2024-09-18

InTheWild.io 2024-09-18

CWE

CWE-434

Status published

Products (1)

telstra/arcadyan_lh1000_firmware < 0.18.15r

Published Sep 20, 2023

Tracked Since Feb 18, 2026