CVE-2023-43743

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-08 · updated 2026-06-17
Weakness: CWE-89

Description

A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an authenticated attacker to execute arbitrary SQL queries on the backend database via the filter parameter in requests to the /newapi/ endpoint in the Zultys MX web interface.

Affected products

Zultys Mx-E Firmware: before 16.0.4; from 17.0.6 before 17.0.10 — fixed in 16.0.4, 17.0.10
Zultys Mx-Se Firmware: before 16.0.4; from 17.0.6 before 17.0.10 — fixed in 16.0.4, 17.0.10
Zultys Mx-Se Ii Firmware: before 16.0.4; from 17.0.6 before 17.0.10 — fixed in 16.0.4, 17.0.10
Zultys Mx-Virtual Firmware: before 16.0.4; from 17.0.6 before 17.0.10 — fixed in 16.0.4, 17.0.10
Zultys Mx250 Firmware: before 16.0.4; from 17.0.6 before 17.0.10 — fixed in 16.0.4, 17.0.10
Zultys Mx30 Firmware: before 16.0.4; from 17.0.6 before 17.0.10 — fixed in 16.0.4, 17.0.10

How to fix

Upgrade to a fixed version: Zultys Mx-E Firmware 16.0.4, 17.0.10; Zultys Mx-Se Firmware 16.0.4, 17.0.10; Zultys Mx-Se Ii Firmware 16.0.4, 17.0.10; Zultys Mx-Virtual Firmware 16.0.4, 17.0.10; Zultys Mx250 Firmware 16.0.4, 17.0.10; Zultys Mx30 Firmware 16.0.4, 17.0.10. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-43743 or the next vulnerability affects your stack