CVE-2023-49565: nokia cbis,ncs Command Injection

Vulnerability summary

CVE-2023-49565 is a high (CVSS 8.4) Command Injection vulnerability in nokia cbis,ncs. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.

Timeline

1. 18-09-2025
   PublishedVulnerability first disclosed.
2. 18-09-2025
   Last modifiedVulnerability information updated.

Description

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without adequate validation, enabling a remote attacker to execute arbitrary commands on the underlying system by crafting malicious header values within an HTTP request to the affected endpoint. The web service executes with root privileges within the container environment, the demonstrated remote code execution permits an attacker to acquire elevated privileges for the command execution. Restricting access to the management network with an external firewall can partially mitigate this risk.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.