Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-22279: MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a re...

CVE-2023-22279 · published 3 years ago

Summary

MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command.

What to do

Update ate-mahoroba maho-pbx_netdevancer_firmware to version 1.11.00 or later.
Update ate-mahoroba maho-pbx_netdevancer_vsg_firmware to version 1.11.00 or later.
Update ate-mahoroba maho-pbx_netdevancer_mobilegate_firmware to version 1.11.00 or later.

Affected software

Vendor	Product	Affected versions
ate-mahoroba	maho-pbx_netdevancer_firmware	< 1.11.00 `cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_firmware:::::lite:::*`
ate-mahoroba	maho-pbx_netdevancer_vsg_firmware	< 1.11.00 `cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_vsg_firmware:::::lite:::*`
ate-mahoroba	maho-pbx_netdevancer_mobilegate_firmware	< 1.11.00 `cpe:2.3:o:ate-mahoroba:maho-pbx_netdevancer_mobilegate_firmware:::::home:::*`

Original advisory text

References

https://jvn.jp/en/jp/JVN99957889/index.html Third Party Advisory
https://www.ate-mahoroba.jp/netdevancer/manual/ Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-78OS Command Injection

Timeline

Published17 Jan 2023

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2023-22279 · NVD

Track software like this

Free during beta