Read the docs
TI-2023-23446 Aliases CVE-2023-43744GHSA-cx8g-cw67-m22j

An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250…

Priority LOW 36CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 and 16.04 patch 16109 allows an administrator to execute arbitrary OS commands via a file name parameter in a patch application function. The Zultys MX Administrator client has a "Patch Manager" section that allows administrators to apply patches to the device. The user supplied filename for the patch file is passed to a shell script without validation. Including bash command substitution characters in a patch file name results in execution of the provided command.

Why it matters now

EPSS 0.01988 80th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:zultys:mx-se_firmware:*:*:*:*:*:*:*:*before 16.0.4; 17.0.6 to before 17.0.10VulnerableZultys
cpe:2.3:h:zultys:mx-se:-:*:*:*:*:*:*:*not specified by NVDRunning onZultys
cpe:2.3:o:zultys:mx-se_ii_firmware:*:*:*:*:*:*:*:*before 16.0.4; 17.0.6 to before 17.0.10VulnerableZultys
cpe:2.3:h:zultys:mx-se_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onZultys
cpe:2.3:o:zultys:mx-e_firmware:*:*:*:*:*:*:*:*before 16.0.4; 17.0.6 to before 17.0.10VulnerableZultys
cpe:2.3:h:zultys:mx-e:-:*:*:*:*:*:*:*not specified by NVDRunning onZultys
cpe:2.3:o:zultys:mx-virtual_firmware:*:*:*:*:*:*:*:*before 16.0.4; 17.0.6 to before 17.0.10VulnerableZultys
cpe:2.3:h:zultys:mx-virtual:-:*:*:*:*:*:*:*not specified by NVDRunning onZultys
cpe:2.3:o:zultys:mx250_firmware:*:*:*:*:*:*:*:*before 16.0.4; 17.0.6 to before 17.0.10VulnerableZultys
cpe:2.3:h:zultys:mx250:-:*:*:*:*:*:*:*not specified by NVDRunning onZultys
  • cpe:2.3:o:zultys:mx-se_firmware:*:*:*:*:*:*:*:* Versions before 16.0.4; 17.0.6 to before 17.0.10 Vulnerable ·Zultys
  • cpe:2.3:h:zultys:mx-se:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zultys
  • cpe:2.3:o:zultys:mx-se_ii_firmware:*:*:*:*:*:*:*:* Versions before 16.0.4; 17.0.6 to before 17.0.10 Vulnerable ·Zultys
  • cpe:2.3:h:zultys:mx-se_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zultys
  • cpe:2.3:o:zultys:mx-e_firmware:*:*:*:*:*:*:*:* Versions before 16.0.4; 17.0.6 to before 17.0.10 Vulnerable ·Zultys
  • cpe:2.3:h:zultys:mx-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zultys
  • cpe:2.3:o:zultys:mx-virtual_firmware:*:*:*:*:*:*:*:* Versions before 16.0.4; 17.0.6 to before 17.0.10 Vulnerable ·Zultys
  • cpe:2.3:h:zultys:mx-virtual:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zultys
  • cpe:2.3:o:zultys:mx250_firmware:*:*:*:*:*:*:*:* Versions before 16.0.4; 17.0.6 to before 17.0.10 Vulnerable ·Zultys
  • cpe:2.3:h:zultys:mx250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zultys
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:zultys:mx30_firmware:*:*:*:*:*:*:*:*before 16.0.4; 17.0.6 to before 17.0.10VulnerableZultys
cpe:2.3:h:zultys:mx30:-:*:*:*:*:*:*:*not specified by NVDRunning onZultys
  • cpe:2.3:o:zultys:mx30_firmware:*:*:*:*:*:*:*:* Versions before 16.0.4; 17.0.6 to before 17.0.10 Vulnerable ·Zultys
  • cpe:2.3:h:zultys:mx30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Zultys

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-43744
  2. 2026-10-03 Alias added: GHSA-cx8g-cw67-m22j

References

Advisory 1

Other 1

  • TI-2023-23444 An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30… CVSS 3.1CRITICAL 9.8
  • TI-2023-23445 A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and… CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences