CVE-2023-54342: Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-05 · updated 2026-10-28
Weakness: CWE-306

Description

Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet connection to the OSGi console, perform a telnet handshake, and send fork commands to download and execute malicious Java code, establishing a reverse shell connection.

Affected products

Eclipse Equinox OSGi: from 3.8 through 3.18

References

https://www.exploit-db.com/exploits/51878
https://www.vulncheck.com/advisories/eclipse-equinox-osgi-console-remote-code-execution

Get alerted when CVE-2023-54342 or the next vulnerability affects your stack