{"id":"CVE-2023-49900","aliases":["EUVD-2023-60600","GHSA-3g8c-pp6x-x9gw"],"status":"published","title":"Origin Validation Error in X-Rite MA-T6","description":"An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00963,"percentile":0.61907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-07-16T10:11:11Z","modified":"2026-09-26T23:10:00Z","products":[{"vendor":"x-rite","product":"ma-t6"}],"references":[{"url":"https://claroty.com/team82/disclosure-dashboard/cve-2023-49900","tags":["related"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49900"},{"url":"https://github.com/advisories/GHSA-3g8c-pp6x-x9gw"}],"sources":{"cve":[{"id":"CVE-2023-49900","title":"Origin Validation Error in X-Rite MA-T6","description":"An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.","status":"published","published":"2026-07-16T10:11:11.925Z","modified":"2026-07-16T15:11:14.497Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:12.998024Z"}],"euvd":[{"id":"EUVD-2023-60600","description":"An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.","status":"published","published":"2026-07-16T10:11:11Z","modified":"2026-07-16T15:11:14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:51.881225Z"}],"ghsa":[{"id":"GHSA-3g8c-pp6x-x9gw","title":"An unauthenticated remote attacker is able to perform remote code execution due to incorrectly...","description":"An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.","status":"published","published":"2026-07-16T12:32:28Z","modified":"2026-07-16T12:32:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:09:33.90316Z"}],"nvd":[{"id":"CVE-2023-49900","description":"An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.","status":"published","published":"2026-07-16T11:16:36.597Z","modified":"2026-09-26T23:10:00.127Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:27.733183Z"}]}}