Vulnerability Description
Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device. The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21255.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Magnetforensics | Axiom | 7.4.0.36841 |
Related Weaknesses (CWE)
References
- https://www.zerodayinitiative.com/advisories/ZDI-23-1533/Third Party Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-23-1533/Third Party Advisory
FAQ
What is CVE-2023-42128?
CVE-2023-42128 is a vulnerability with a CVSS score of 8.0 (HIGH). Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensi...
How severe is CVE-2023-42128?
CVE-2023-42128 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-42128?
Check the references section above for vendor advisories and patch information. Affected products include: Magnetforensics Axiom.