CVE-2023-49959

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-26 · updated 2026-06-17
Weakness: CWE-77

Description

In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to the /api/updater/ctrl/start_update endpoint.

Affected products

Indu-Sol Profinet-Inspektor Nt: before 2.4.1 — fixed in 2.4.1

How to fix

Upgrade to a fixed version: Indu-Sol Profinet-Inspektor Nt 2.4.1. Check the vendor advisory for mitigations.

References

https://code-white.com/public-vulnerability-list/
https://www.indu-sol.com/en/products/profinet/diagnostics/profinet-inspektorr-nt/
https://code-white.com/public-vulnerability-list/
https://www.indu-sol.com/en/products/profinet/diagnostics/profinet-inspektorr-nt/

Get alerted when CVE-2023-49959 or the next vulnerability affects your stack