OS command injection in KbDevice,Inc. KB-AHR series and KB-IRIP series
Priority MEDIUM 52CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-78.
Summary
OS command injection vulnerability exists in KB-AHR series and KB-IRIP series. If this vulnerability is exploited, an arbitrary OS command may be executed on the product or the device settings may be altered. Affected products and versions are as follows: KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01487 74th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| KbDevice,Inc. | KB-AHR series and KB-IRIP series | KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A | — | No fix listed | CNA |
- KB-AHR series and KB-IRIP series VendorKbDevice,Inc. Affected KB-AHR04D versions prior to 91110.1.101106.78, KB-AHR08D versions prior to 91210.1.101106.78, KB-AHR16D versions prior to 91310.1.101106.78, KB-IRIP04A versions prior to 95110.1.100290.78A, KB-IRIP08A versions prior to 95210.1.100290.78A, and KB-IRIP16A versions prior to 95310.1.100290.78A Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:kbdevice:kb-ahr04d_firmware:*:*:*:*:*:*:*:* | before 91110.1.101106.78 | Vulnerable | KbDevice,Inc. |
| cpe:2.3:h:kbdevice:kb-ahr04d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | KbDevice,Inc. |
| cpe:2.3:o:kbdevice:kb-ahr08d_firmware:*:*:*:*:*:*:*:* | before 91210.1.101106.78 | Vulnerable | KbDevice,Inc. |
| cpe:2.3:h:kbdevice:kb-ahr08d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | KbDevice,Inc. |
| cpe:2.3:o:kbdevice:kb-ahr16d_firmware:*:*:*:*:*:*:*:* | before 91310.1.101106.78 | Vulnerable | KbDevice,Inc. |
| cpe:2.3:h:kbdevice:kb-ahr16d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | KbDevice,Inc. |
| cpe:2.3:o:kbdevice:kb-irip04a_firmware:*:*:*:*:*:*:*:* | before 95110.1.100290.78a | Vulnerable | KbDevice,Inc. |
| cpe:2.3:h:kbdevice:kb-irip04a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | KbDevice,Inc. |
| cpe:2.3:o:kbdevice:kb-irip08a_firmware:*:*:*:*:*:*:*:* | before 95210.1.100290.78a | Vulnerable | KbDevice,Inc. |
| cpe:2.3:h:kbdevice:kb-irip08a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | KbDevice,Inc. |
- cpe:2.3:o:kbdevice:kb-ahr04d_firmware:*:*:*:*:*:*:*:* Versions before 91110.1.101106.78 Vulnerable ·KbDevice,Inc.
- cpe:2.3:h:kbdevice:kb-ahr04d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·KbDevice,Inc.
- cpe:2.3:o:kbdevice:kb-ahr08d_firmware:*:*:*:*:*:*:*:* Versions before 91210.1.101106.78 Vulnerable ·KbDevice,Inc.
- cpe:2.3:h:kbdevice:kb-ahr08d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·KbDevice,Inc.
- cpe:2.3:o:kbdevice:kb-ahr16d_firmware:*:*:*:*:*:*:*:* Versions before 91310.1.101106.78 Vulnerable ·KbDevice,Inc.
- cpe:2.3:h:kbdevice:kb-ahr16d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·KbDevice,Inc.
- cpe:2.3:o:kbdevice:kb-irip04a_firmware:*:*:*:*:*:*:*:* Versions before 95110.1.100290.78a Vulnerable ·KbDevice,Inc.
- cpe:2.3:h:kbdevice:kb-irip04a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·KbDevice,Inc.
- cpe:2.3:o:kbdevice:kb-irip08a_firmware:*:*:*:*:*:*:*:* Versions before 95210.1.100290.78a Vulnerable ·KbDevice,Inc.
- cpe:2.3:h:kbdevice:kb-irip08a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·KbDevice,Inc.
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:kbdevice:kb-irip16a_firmware:*:*:*:*:*:*:*:* | before 95310.1.100290.78a | Vulnerable | KbDevice,Inc. |
| cpe:2.3:h:kbdevice:kb-irip16a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | KbDevice,Inc. |
- cpe:2.3:o:kbdevice:kb-irip16a_firmware:*:*:*:*:*:*:*:* Versions before 95310.1.100290.78a Vulnerable ·KbDevice,Inc.
- cpe:2.3:h:kbdevice:kb-irip16a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·KbDevice,Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-30764
- 2026-10-03 Alias added: GHSA-6j99-q3r3-p2gh
References
More KbDevice,Inc. Kb-ahr04d Firmware vulnerabilities
- TI-2023-14579 Hidden functionality issue exists in KB-AHR series and KB-IRIP series. CVSS 3.1CRITICAL 9.8
- TI-2023-14575 Missing authentication in KbDevice,Inc. KB-AHR series and KB-IRIP series CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-30764 · CVE Program
- CVE-2023-30764 · NVD
- FIRST EPSS
- GHSA-6j99-q3r3-p2gh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences