CVE-2023-37292: HGiga iSherlock - Command Injection

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.3% · higher than 71% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

I4

iSherlock 4.5 · HGiga

before iSherlock-user-4.5-174 · source: vendor

I5

iSherlock 5.5 · HGiga

before iSherlock-user-5.5-174 · source: vendor

IS

Isherlock · Hgiga

4.5 before 4.5-174; 5.5 before 5.5-174 · source: NVD, CISA