cbcvebase.
CVE-2023-26602
published 2023-02-26

CVE-2023-26602: ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for…

PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
17.40%
96.8th percentile
ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.

Affected

1 ranges
VendorProductVersion rangeFixed in
asusasmb8-ikvm_firmware<= 1.14.51—

Detection & IOCsextracted from sources · hover to see the quote

commandsnmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution↗
path/bin/sh↗
  • →Monitor SNMP SET requests targeting NET-SNMP-EXTEND-MIB OIDs, particularly those registering /bin/sh or other shell interpreters as extension commands — this is the primary exploitation vector for CVE-2023-26602. ↗
  • →Detect SSH login attempts to ASUS ASMB8 iKVM devices using legacy/weak host key algorithms (ssh-dss), which is characteristic of post-exploitation access after the defshell bypass. ↗
  • →Alert on successful SSH root shell sessions to ASMB8 iKVM devices running BusyBox/ash, especially where the login shell has been changed from the restricted defshell to /bin/sh. ↗
  • →Look for SNMP-initiated reads or writes to /etc/passwd and /etc/shadow on ASMB8 iKVM devices, which may indicate credential harvesting following RCE via SNMP extension abuse. ↗
  • ·The vulnerability affects ASUS ASMB8 iKVM firmware through version 1.14.51 only; verify firmware version before applying detections to avoid false positives on patched devices. ↗
  • ·The device runs a very old kernel (2.6.28.10, built 2017) and BusyBox v1.13.2; standard EDR/endpoint agents are unlikely to be deployable on this embedded ARM platform — network-layer SNMP inspection is the primary detection surface. ↗
  • ·The ssh-dss (DSA) host key algorithm is required by the attacker's SSH client to connect post-exploitation; blocking or alerting on ssh-dss negotiation to BMC/iKVM management IPs is a low-noise detection opportunity. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.