CVE-2023-24958: IBM TS7700 Management Interface command injection

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-04 · updated 2026-06-17
Weakness: CWE-78

Description

A vulnerability in the IBM TS7700 Management Interface 8.51.2.12, 8.52.200.111, 8.52.102.13, and 8.53.0.63 could allow an authenticated user to submit a specially crafted URL leading to privilege escalation and remote code execution. IBM X-Force ID: 246320.

Affected products

IBM 3948-Ved Firmware: from 8.53.0 through 8.53.0.63
IBM 3957-Vec Firmware: from 8.51.0 before 8.51.2.12; from 8.52.100.0 before 8.52.102.13 — fixed in 8.51.2.12, 8.52.102.13
IBM 3957-Ved Firmware: from 8.51.0 before 8.51.2.12; from 8.52.100.0 before 8.52.102.13; from 8.52.200.0 before 8.52.200.111; from 8.53.0 before 8.53.0.63 — fixed in 8.51.2.12, 8.52.102.13, 8.52.200.111, 8.53.0.63

How to fix

Upgrade to a fixed version: IBM 3957-Vec Firmware 8.51.2.12, 8.52.102.13; IBM 3957-Ved Firmware 8.51.2.12, 8.52.102.13, 8.52.200.111, 8.53.0.63. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-24958 or the next vulnerability affects your stack