CVE-2023-40144
OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.14% probability · 82th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- cbc/nr4h firmware · cbc/nr8h firmware · cbc/nr16h firmware · cbc/dr-16f42a firmware · cbc/dr-16f45at firmware · cbc/dr-8f42a firmware · cbc/dr-8f45at firmware · cbc/dr-4fx1 firmware · cbc/dr-16h firmware · cbc/dr-8h firmware · cbc/dr-4h firmware · cbc/drh8-4m41-a firmware · cbc/nr8-4m71 firmware · cbc/nr8-8m72 firmware · cbc/nr-16m firmware · cbc/nr-16f85-8pra firmware · cbc/nr-16f82-16p firmware · cbc/nr-4f firmware · cbc/nr-8f firmware · cbc/dr-16m52 firmware · +3 more
- Source
- vultures@jpcert.or.jp
EPSS 2.1% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://download.ganzsecurity.pl/Product
- https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-noticeVendor Advisory
- https://jvn.jp/en/vu/JVNVU92545432/Third Party Advisory
- https://download.ganzsecurity.pl/Product
- https://ganzsecurity.com/release/1578/digimasterpixelmaster-security-noticeVendor Advisory
- https://jvn.jp/en/vu/JVNVU92545432/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.