Lockcell Firmware
CVE-2023-3049
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection.This issue affects Lockcell: before 15.
AnalysisAI
Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted Upload of File with Dangerous Type vulnerability in TMT Lockcell allows Command Injection. Affected products include: Tmtmakine Lockcell Firmware. Version information: before 15..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.
More in Lockcell Firmware
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMT Lockcell allow
Authorization Bypass Through User-Controlled Key vulnerability in TMT Lockcell allows Authentication Abuse, Authenticati
Reliance on Cookies without Validation and Integrity Checking in a Security Decision vulnerability in TMT Lockcell allow
Same technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today