{"id":"CVE-2023-26609","aliases":["EUVD-2023-30404","GHSA-8mvx-pm2m-j8f7"],"status":"published","title":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell...","description":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.38722,"percentile":0.98594,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2023-02-27T00:00:00Z","modified":"2026-06-17T05:43:42Z","exploits":[{"source":"exploitdb","id":"EDB-51294","title":"ABUS Security Camera TVIP 20000-21150 - LFI_ RCE and SSH Root Access","type":"remote","platform":"hardware","date":"2023-04-06","url":"https://www.exploit-db.com/exploits/51294"},{"source":"pocgithub","id":"D1G17/CVE-2023-26609","title":"D1G17/CVE-2023-26609","date":"2024-01-16","url":"https://github.com/D1G17/CVE-2023-26609"}],"products":[{"vendor":"abus","product":"tvip_20000-21150_firmware"}],"references":[{"url":"https://nwsec.de/NWSSA-001-2023.txt","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/171136/ABUS-Security-Camera-TVIP-20000-21150-LFI-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2023/Feb/16","tags":["mailing-list","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26609"},{"url":"https://github.com/advisories/GHSA-8mvx-pm2m-j8f7"}],"sources":{"cve":[{"id":"CVE-2023-26609","description":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.","status":"published","published":"2023-02-27T00:00:00Z","modified":"2025-05-05T16:03:46.043Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-30404","description":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.","status":"published","published":"2023-02-27T00:00:00Z","modified":"2025-05-05T16:03:46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:56.98956Z"}],"ghsa":[{"id":"GHSA-8mvx-pm2m-j8f7","title":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell...","description":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.","status":"published","published":"2023-02-27T03:30:23Z","modified":"2023-03-08T00:30:33Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:54:17.182344Z"}],"nvd":[{"id":"CVE-2023-26609","description":"ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field.","status":"published","published":"2023-02-27T02:16:06.68Z","modified":"2026-06-17T05:43:42.69Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:47.623983Z"}]}}