CVE-2023-37265 - CVE House

Back to Database

Status published Critical CVE-2023-37265

Incorrect identification of source IP addresses in CasaOS

9.8 CVSS

Vulnerability Description

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in `391dd7f`. This patch is part of CasaOS 0.4.4. Users should upgrade to CasaOS 0.4.4. If they can't, they should temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-37265

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from IceWhaleTech

View All →

ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)

ZimaOS Privilege Escalation using localhost calls to File API Upload

ZimaOS reads arbitrary files using localhost calls to File API Download

ZimaOS vulnerable to Directory Listing via Parameter Manipulation

ZimaOS vulnerable to Username Enumeration via API Responses

Affected Vendor

IceWhaleTech

View all reports →

Affected Software

CasaOS-Gateway

Vulnerable Versions:

< 0.4.4

Timeline

Official Publish: July 17th, 2023

Last Modified: December 12th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1136 Create Account

T1098 Account Manipulation

Privilege Escalation

T1021 Remote Services

Lateral Movement