Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2023-36650: A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.
CVE-2023-36650 · published 2 years ago
Summary
A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| prolion | cryptospike |
3.0.15 cpe:2.3:a:prolion:cryptospike:3.0.15:p2:*:*:*:*:*:* |
Original advisory text
A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.
A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.
References
- https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36650 Exploit Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-354Improper Validation of Integrity Check Value
Timeline
Published12 Dec 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2023-36650 · NVD
Track software like this
Free during beta