Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-53908. PoCs published by dreizehnutters.
AI-analyzed exploit summary This exploit leverages an XML-based privilege escalation vulnerability in HiSecOS by modifying the user's access role to admin (role ID 15) via a crafted RPC payload. It requires valid credentials and sends an authenticated POST request to the target's management interface.
Description
HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configuration. Attackers can send crafted XML payloads to the /mops_data endpoint with a specific role value to elevate their user privileges to administrative level.
Exploits (1)
This exploit leverages an XML-based privilege escalation vulnerability in HiSecOS by modifying the user's access role to admin (role ID 15) via a crafted RPC payload. It requires valid credentials and sends an authenticated POST request to the target's management interface.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H