CVE-2023-30764 json
OS command injection vulnerability exists in KB-AHR series and KB-IRIP series.
published 2023-06-13 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-35128
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
Patch / fix
- kbdevice kb-ahr04d_firmware 91110.1.101106.78
- kbdevice kb-ahr08d_firmware 91210.1.101106.78
- kbdevice kb-ahr16d_firmware 91310.1.101106.78
- kbdevice kb-irip04a_firmware 95110.1.100290.78a
- kbdevice kb-irip08a_firmware 95210.1.100290.78a
- kbdevice kb-irip16a_firmware 95310.1.100290.78a
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 22 mo ago
Exploit prediction
1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- KbDevice,Inc. KB-AHR series and KB-IRIP series
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
kbdevice.com
/news/%e3%83%ac%e3%82%b3%e3%83%bc%e3%83%80%e3%83%bc%e3%81%ae%e3%83%8d%e3%83%83%e3%83%88%e3%83%af%e3%83%bc%e3%8
mitigation, vendor-advisory
-
jvn.jp
/en/vu/JVNVU90812349/
third-party-advisory
Sources
- CVE List CVE-2023-30764
- NVD CVE-2023-30764
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.