Read the docs
TI-2023-22594 Aliases CVE-2023-42419GHSA-9vcf-g8ph-g2mx

Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)

Priority LOW 17Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the server. The issue was resolved in version 2.28. Earlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world remain unaffected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed Maintenance Server (Cybellum): 2.0, 2.28

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CybellumMaintenance Server2.15.5 – 2.272.0, 2.28Patch availableCNA
  • Maintenance Server VendorCybellum Affected 2.15.5 – 2.27 Fixed in 2.0, 2.28 Patch available CNA

Remediation

  • Fix · CNA Maintenance Server (Cybellum) Fixed in 2.0, 2.28

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-42419
  2. 2026-10-03 Alias added: GHSA-9vcf-g8ph-g2mx

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences