Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)
Vulnerability Description
Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-54329
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- a-rey
References
- https://www.exploit-db.com/exploits/51127
- https://web.archive.org/web/20200122082432/https://www.softsea.com/review/Inbit-Messenger-Basic-Edition.html
- https://github.com/a-rey/exploits/blob/main/writeups/Inbit_Messenger/v4.6.0/writeup.md
- https://www.vulncheck.com/advisories/inbit-messenger-unauthenticated-remote-command-execution-rce
Affected Vendor
Inbit
View all reports →