Read the docs
TI-2023-18922 Aliases CVE-2023-37292GHSA-h962-83vh-m65j

HGiga iSherlock - Command Injection

Priority MEDIUM 46CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in HGiga iSherlock 4.5 (iSherlock-user modules), HGiga iSherlock 5.5 (iSherlock-user modules) allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock 5.5: before iSherlock-user-5.5-174.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01318 70th percentileScored 2026-11-07
Fix Fixed iSherlock 4.5 (HGiga): iSherlock-user-4.5-174iSherlock 5.5 (HGiga): iSherlock-user-5.5-174

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HGigaiSherlock 4.5 to before iSherlock-user-4.5-174iSherlock-user-4.5-174Patch availableCNA
HGigaiSherlock 5.5 to before iSherlock-user-5.5-174iSherlock-user-5.5-174Patch availableCNA
  • iSherlock 4.5 VendorHGiga Affected to before iSherlock-user-4.5-174 Fixed in iSherlock-user-4.5-174 Patch available CNA
  • iSherlock 5.5 VendorHGiga Affected to before iSherlock-user-5.5-174 Fixed in iSherlock-user-5.5-174 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hgiga:isherlock:*:*:*:*:*:*:*:*4.5 to before 4.5-174; 5.5 to before 5.5-174VulnerableHGiga
  • cpe:2.3:a:hgiga:isherlock:*:*:*:*:*:*:*:* Versions 4.5 to before 4.5-174; 5.5 to before 5.5-174 Vulnerable ·HGiga

Remediation

  • Fix · CNA iSherlock 4.5 (HGiga) Fixed in iSherlock-user-4.5-174
  • Fix · CNA iSherlock 5.5 (HGiga) Fixed in iSherlock-user-5.5-174

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37292
  2. 2026-10-03 Alias added: GHSA-h962-83vh-m65j

References

Advisory 1

  • TI-2024-04002 HGiga iSherlock - Command Injection CVSS 3.1HIGH 7.2
  • TI-2024-04001 HGiga iSherlock - Command Injection CVSS 3.1HIGH 7.2
  • TI-2024-03999 HGiga iSherlock - Arbitrary File Download CVSS 3.1MEDIUM 4.9
  • TI-2024-04000 HGiga iSherlock - Arbitrary File Download CVSS 3.1MEDIUM 4.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences