Read the docs
TI-2023-24396 Aliases CVE-2023-45593GHSA-j594-4mw2-8pmc

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium…

Priority LOW 32CWE-184Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs, other than “ http://localhost” ) allows a physical attacker to read arbitrary files on the file system, alter the configuration of the embedded browser, and have other unspecified impacts to the confidentiality, integrity, and availability of the device. This issue affects: AiLux imx6 bundle below version imx6_1.0.7-2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00264 18th percentileScored 2026-11-08
Fix Fixed imx6 bundle (AiLux): 1.0.7-2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AiLuximx6 bundlebefore 1.0.7-21.0.7-2Patch availableCNA
  • imx6 bundle VendorAiLux Affected before 1.0.7-2 Fixed in 1.0.7-2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:*before 1.0.7-2VulnerableAiLux
  • cpe:2.3:a:ailux:imx6:*:*:*:*:*:*:*:* Versions before 1.0.7-2 Vulnerable ·AiLux

Remediation

  • Fix · CNA imx6 bundle (AiLux) Fixed in 1.0.7-2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    AiLux imx6 bundle 1.0.7-2

    12 records Highest priority Priority MEDIUM 7 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2023-05022 A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django…Priority MEDIUM 49
    • TI-2023-24403 Insufficient session expiration in AiLux imx6 bundlePriority MEDIUM 48
    • TI-2023-24395 A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium…Priority MEDIUM 44
    Show all 12 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45593
  2. 2026-10-03 Alias added: GHSA-j594-4mw2-8pmc

References

Advisory 1

  • TI-2023-05022 A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django… CVSS 3.1CRITICAL 9.8
  • TI-2023-24403 Insufficient session expiration in AiLux imx6 bundle CVSS 3.1CRITICAL 9.8
  • TI-2023-24395 A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium… CVSS 3.1CRITICAL 9.8
  • TI-2023-05021 Hard-coded credentials in AiLux imx6 bundle CVSS 3.1CRITICAL 9.8
  • TI-2023-24400 CSV injection in AiLux imx6 bundle CVSS 3.1CRITICAL 9.0
  • TI-2023-24394 Heap-based buffer overflow in AiLux imx6 bundle CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences