CVE-2023-6899: rmountjoy92 DashMachine Config save_config code injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-12-17 · updated 2026-06-17
Weakness: CWE-94

Description

A vulnerability classified as problematic was found in rmountjoy92 DashMachine 0.5-4. Affected by this vulnerability is an unknown functionality of the file /settings/save_config of the component Config Handler. The manipulation of the argument value_template leads to code injection. The exploit has been disclosed to the public and may be used. The identifier VDB-248257 was assigned to this vulnerability.

Affected products

rmountjoy92 DashMachine: 0.5-4

References

https://treasure-blarney-085.notion.site/DashMachine-Unauthorized-RCE-931a35a81af9448ebe9fb4cd904d4a0c
https://vuldb.com/?ctiid.248257
https://vuldb.com/?id.248257
https://treasure-blarney-085.notion.site/DashMachine-Unauthorized-RCE-931a35a81af9448ebe9fb4cd904d4a0c
https://vuldb.com/?ctiid.248257
https://vuldb.com/?id.248257

Get alerted when CVE-2023-6899 or the next vulnerability affects your stack