Ctrl + K
/ news / CVE
CVE•Published 2023-07-11•Modified 2026-10-23•1 article on news•7 live references•NVD data

CVE-2023-36751Siemens · Ruggedcom_rox_mx5000_firmware

Vulnerability data via NVD (ingested)

CVSS v3.1
9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS percentile
74
Exploit Prediction Scoring System · top 26% of all CVEs
Weaknesses (CWE)
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versions < V2.16.0), RUGGEDCOM ROX RX1400 (All versions < V2.16.0), RUGGEDCOM ROX RX1500 (All versions < V2.16.0), RUGGEDCOM ROX RX1501 (All versions < V2.16.0), RUGGEDCOM ROX RX1510 (All versions < V2.16.0), RUGGEDCOM ROX RX1511 (All versions < V2.16.0), RUGGEDCOM ROX RX1512 (All versions < V2.16.0), RUGGEDCOM ROX RX1524 (All versions < V2.16.0), RUGGEDCOM ROX RX1536 (All versions < V2.16.0), RUGGEDCOM ROX RX5000 (All versions < V2.16.0). The install-app URL parameter in the web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Timeline
Published 2023-07-11
Modified 2026-10-23

External references

NVDMITREExploit-DBGitHub PoCSploitustrickest/cveVulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts
vuln:CVE-2023-36751
Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · OS
os:"Ruggedcom Rox Mx5000 Firmware"
Hosts Shodan identified as running Ruggedcom Rox Mx5000 Firmware.
More intel sources (5)
Shodan report
vuln:CVE-2023-36751
Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2023-36751
Censys host search filtered to this CVE id.
grep.app
CVE-2023-36751
Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2023-36751
GitHub code search for direct mentions.
Google dork
"CVE-2023-36751" exploit -site:nvd.nist.gov
Write-ups and news, NVD excluded.

Known PoCs on GitHub

No public proof-of-concept repositories found for CVE-2023-36751 on GitHub.
Articles on news mentioning CVE-2023-36751