← back
CVE-2023-32752

L7 Networks InstantScan & InstantQoS - Arbitrary File Upload

CVSS 9.8 CRITICALEPSS 0.9%CWE-434
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.8EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
16 Jun 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
L7 Networks · InstantQoSL7 Networks · InstantScan

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://www.twcert.org.tw/en/cp-139-7189-5995e-2.html