{"id":"CVE-2023-36177","aliases":["DEBIAN-CVE-2023-36177","DLA-4252-1","DSA-5847-1","EUVD-2023-40156","GHSA-hgrc-r3ff-wxfq","UBUNTU-CVE-2023-36177","USN-8767-1"],"status":"published","title":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute...","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.27523,"percentile":0.98091,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-01-23T00:00:00Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Debian:12","package":"snapcast","fixed_in":["0.26.0+dfsg1-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"snapcast","fixed_in":["0.30.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"snapcast","fixed_in":["0.30.0-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"snapcast","fixed_in":["0.23.0+dfsg1-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snapcast","fixed_in":["0.18.1-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"snapcast","fixed_in":["0.25.0+dfsg1-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"snapcast","fixed_in":["0.27.0+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0+dfsg1-1+deb12u1"}]}],"versions":["0.26.0+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:13","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.30.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.23.0+dfsg1-1+deb11u1"}]}],"versions":["0.23.0+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:12","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0+dfsg1-1+deb12u1"}]}],"versions":["0.26.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-1ubuntu0.1~esm1"}]}],"versions":["0.15.0-1","0.18.0-1","0.18.1-1","0.18.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.0+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["0.23.0+dfsg1-1","0.25.0+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0+dfsg-1ubuntu0.1~esm1"}]}],"versions":["0.27.0+dfsg-1","0.27.0+dfsg-1build1","0.27.0+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.1-1ubuntu0.1~esm1"}]}],"versions":["0.15.0-1","0.18.0-1","0.18.1-1","0.18.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.25.0+dfsg1-2ubuntu0.1~esm1"}]}],"versions":["0.23.0+dfsg1-1","0.25.0+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"snapcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.27.0+dfsg-1ubuntu0.1~esm1"}]}],"versions":["0.27.0+dfsg-1","0.27.0+dfsg-1build1","0.27.0+dfsg-1build2"]}],"products":[{"vendor":"badaix","product":"snapcast"}],"references":[{"url":"https://oxnan.com/posts/Snapcast_jsonrpc_rce","tags":["x_transferred","Exploit","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/07/msg00015.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36177","tags":["advisory"]},{"url":"http://snapcast.com"},{"url":"https://github.com/advisories/GHSA-hgrc-r3ff-wxfq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36177.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-36177","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-36177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36177","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8767-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-36177","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-23T00:00:00Z","modified":"2026-07-09T00:26:39.135Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:27.810438Z"}],"euvd":[{"id":"EUVD-2023-40156","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-23T00:00:00Z","modified":"2026-07-09T00:26:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:06.275812Z"}],"ghsa":[{"id":"GHSA-hgrc-r3ff-wxfq","title":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute...","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-24T00:30:32Z","modified":"2025-11-03T21:31:00Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:18.722049Z"}],"nvd":[{"id":"CVE-2023-36177","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-23T22:15:16.39Z","modified":"2026-07-09T01:18:28.833Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:01.900189Z"}],"osv":[{"id":"CVE-2023-36177","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-23T00:00:00Z","modified":"2026-10-28T02:31:09.580860015Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"DEBIAN-CVE-2023-36177","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-23T22:15:16.39Z","modified":"2026-10-26T18:03:05.893834632Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"UBUNTU-CVE-2023-36177","description":"An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API.","status":"published","published":"2024-01-23T22:15:00Z","modified":"2026-09-15T20:16:34.757836377Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"DLA-4252-1","title":"snapcast - security update","status":"published","published":"2025-07-27T00:00:00Z","modified":"2026-03-09T02:09:26.387795Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5847-1","title":"snapcast - security update","status":"published","published":"2025-01-21T00:00:00Z","modified":"2026-03-09T02:08:42.339313Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"USN-8767-1","title":"snapcast vulnerability","description":"It was discovered that Snapcast incorrectly handled crafted JSON-RPC\nrequests. A remote attacker could possibly use this issue to execute\narbitrary code or obtain sensitive information.","status":"published","published":"2026-09-15T15:22:17Z","modified":"2026-09-16T02:57:27.437790819Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}