Infoblox Security Update – 28 August 2023

The severity of the addressed vulnerability could allow the remote attacker to execute arbitrary code on the system by sending a specially crafted request.

The addressed vulnerability arises due to a flawed component that doesn’t properly sanitize incoming malicious input. Its exploitation requires the malicious actors to access an authenticated feature within the NIOS UI, enabling them to execute the malicious input and gain shell access.

Infoblox NIOS code execution (CVE-2023-37249):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access