CVE-2023-38585

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-23 · updated 2026-06-17
Weakness: CWE-287

Description

Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and DR-16F, DR-8F, DR-4F, DR-16H, DR-8H, DR-4H, DR-4M41 series are no longer supported, therefore updates for those products are not provided.

Affected products

Cbc Dr-16F42A Firmware: all versions
Cbc Dr-16F45At Firmware: all versions
Cbc Dr-16H Firmware: all versions
Cbc Dr-16M52-Av Firmware: all versions
Cbc Dr-16M52 Firmware: all versions
Cbc Dr-4Fx1 Firmware: all versions
Cbc Dr-4H Firmware: all versions
Cbc Dr-4M51-Av Firmware: all versions
Cbc Dr-8F42A Firmware: all versions
Cbc Dr-8F45At Firmware: all versions
Cbc Dr-8H Firmware: all versions
Cbc Dr-8M52-Av Firmware: all versions
Cbc Drh8-4M41-A Firmware: all versions
Cbc Nr-16F82-16P Firmware: all versions
Cbc Nr-16F85-8Pra Firmware: all versions
Cbc Nr-16M Firmware: all versions
Cbc Nr-4F Firmware: all versions
Cbc Nr-8F Firmware: all versions
Cbc Nr16H Firmware: all versions
Cbc Nr4H Firmware: all versions
Cbc Nr8-4M71 Firmware: all versions
Cbc Nr8-8M72 Firmware: all versions
Cbc Nr8H Firmware: all versions

References

Get alerted when CVE-2023-38585 or the next vulnerability affects your stack