CVE-2023-23063
published 2023-02-22CVE-2023-23063: Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
PriorityP275high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.43%
82.2th percentile
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cellinx | nvt_web_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/cgi-bin/GetFileContent.cgi?USER=root&PWD=D1D1D1D1D1D1D1D1D1D1D1D1A2A2B0A1D1D1D1D1D1D1D1D1D1D1D1D1D1D1B8D1&PATH=/etc/passwd
- →Exploit requests target GET /cgi-bin/GetFileContent.cgi with USER, PWD, and PATH parameters; look for PATH=/etc/passwd or other absolute paths indicating LFI attempts.
- →Successful exploitation returns HTTP 200 with a body matching 'root:.*:0:0:' (passwd file content) and a response header containing 'TRACKID='.
- →Fingerprint vulnerable Cellinx NVT devices via FOFA query: body contains '/viewer/viewer.html', response header contains 'lighttpd', and country is 'KR'.
- →The hardcoded PWD value 'D1D1D1D1D1D1D1D1D1D1D1D1A2A2B0A1D1D1D1D1D1D1D1D1D1D1D1D1D1D1B8D1' appears to be a default/static credential used in exploitation; flag requests containing this value.
- ·The vulnerability affects specifically Cellinx NVT version 1.0.6.002b; detections should be scoped to this version to avoid false positives on other products. ↗
- ·The exploit is unauthenticated (PR:N) and network-accessible (AV:N), meaning no prior authentication is required; perimeter-level detection/blocking of requests to GetFileContent.cgi is viable.
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-94xq-jfvq-m5cx: Cellinx NVT v1
ghsa_unreviewed·2023-02-22
CVE-2023-23063 [HIGH] CWE-22 GHSA-94xq-jfvq-m5cx: Cellinx NVT v1
Cellinx NVT v1.0.6.002b is vulnerable to local file disclosure.
VulnCheck
cellinx nvt_web_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulncheck·2023·CVSS 7.5
CVE-2023-23063 [HIGH] cellinx nvt_web_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
cellinx nvt_web_server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
Affected: cellinx nvt_web_server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-08&host_type=src&vulnerability=cve-2023-23063; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-06-09&host_type=src&vulnerability=cve-2023-23063; https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2
No detection rules found.
Nuclei
Cellinx NVT Web Server - Local File Disclosure
nuclei·CVSS 7.5
CVE-2023-23063 [HIGH] Cellinx NVT Web Server - Local File Disclosure
Cellinx NVT Web Server - Local File Disclosure
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
Template:
id: CVE-2023-23063
info:
name: Cellinx NVT Web Server - Local File Disclosure
author: daffainfo
severity: high
description: |
Cellinx NVT v1.0.6.002b was discovered to contain a local file disclosure vulnerability via the component /cgi-bin/GetFileContent.cgi.
impact: |
Unauthenticated attackers can read arbitrary files from the server through the PATH parameter in GetFileContent.cgi, potentially exposing system credentials, configuration files, and sensitive video surveillance data.
remediation: |
Update Cellinx NVT to a version newer than 1.0.6.002b that validates file paths in GetFileContent.cg
No writeups or analysis indexed.
2023-02-22
Published
Exploited in the wild