{"id":"CVE-2023-26602","aliases":["EUVD-2023-30397","GHSA-hjqf-pmj4-5mh7"],"status":"published","title":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by...","description":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.17399,"percentile":0.97163,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2023-02-26T00:00:00Z","modified":"2026-06-17T05:43:41Z","exploits":[{"source":"exploitdb","id":"EDB-52244","title":"ASUS ASMB8 iKVM 1.14.51 - Remote Code Execution (RCE)","type":"local","platform":"hardware","date":"2025-04-16","url":"https://www.exploit-db.com/exploits/52244"},{"source":"pocgithub","id":"D1G17/CVE-2023-26602","title":"D1G17/CVE-2023-26602","date":"2024-01-16","url":"https://github.com/D1G17/CVE-2023-26602"}],"products":[{"vendor":"asus","product":"asmb8-ikvm_firmware"}],"references":[{"url":"https://nwsec.de/NWSSA-002-2023.txt","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/171137/ASUS-ASMB8-iKVM-1.14.51-SNMP-Remote-Root.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2023/Feb/15","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26602"},{"url":"https://github.com/advisories/GHSA-hjqf-pmj4-5mh7"}],"sources":{"cve":[{"id":"CVE-2023-26602","description":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.","status":"published","published":"2023-02-26T00:00:00Z","modified":"2025-03-11T18:18:49.617Z","updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-30397","description":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.","status":"published","published":"2023-02-26T00:00:00Z","modified":"2025-03-11T18:18:49Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-02T20:53:06.845495Z"}],"ghsa":[{"id":"GHSA-hjqf-pmj4-5mh7","title":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by...","description":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.","status":"published","published":"2023-02-26T21:30:22Z","modified":"2023-03-15T05:07:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:54:20.892008Z"}],"nvd":[{"id":"CVE-2023-26602","description":"ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.","status":"published","published":"2023-02-26T20:15:10.697Z","modified":"2026-06-17T05:43:41.45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:07:47.623983Z"}]}}