CVE-2023-4873Smart S45F Multi-Service Secure Gateway Intelligent Management Platform OS Command Injection
A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906.
Published Sep 10, 2023 · Updated Jun 25, 2025
Key Facts
Patch immediately- CVE-2023-4873 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Smart S45f Firmware (Byzoro), Smart S45F Multi-Service Secure Gateway Intelligent Management Platform.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 22% probability of exploitation in the next 30 days.
- Fixed versions are available, including Smart S45f Firmware <=20230906, Smart S45f Firmware 20230906.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
22%
Higher than 97.6% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
39/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection.
It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-239358 is the identifier assigned to this vulnerability.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Smart S45f FirmwareByzoro | See advisory | 20230906 |
| Smart S45F Multi-Service Secure Gateway Intelligent Management Platform | >= 20230906 | n/a |
Patched Releases
Smart S45f Firmware
<=20230906
Timeline
Publicly disclosed
Sep 10, 2023
Last updated
Jun 25, 2025
Weakness Type
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryVDB-239358 | CTI Indicators (IOB, IOC, TTP, IOA)
- advisoryVDB-239358 | Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php os command injection
- exploitgithub.com · rce.md
- otherSubmit #204279 | The Smart S45F multi-service security gateway intelligent management platform has an rce injection vulnerability
FAQ
Common Questions.
A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906.
Affected: Smart S45f Firmware (Byzoro); Smart S45F Multi-Service Secure Gateway Intelligent Management Platform versions >= 20230906. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Smart S45f Firmware <=20230906, Smart S45f Firmware 20230906.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2023-4873 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo