CVE-2023-7093 — A vulnerability classified as critical has been found in KylinSoft kylin-system-

A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The

01What is this vulnerability?

A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached…

02Affected products

Vendor	Product	Versions
KylinSoft	kylin	system-updater — 2.0.5.16-0k2.0, 2.0.5.16-0k2.1, 2.0.5.16-0k2.2, 2.0.5.16-0k2.3, 2.0.5.16-0k2.4, 2.0.5.16-0k2.5, 2.0.5.16-0k2.6, 2.0.5.16-0k2.7, 2.0.5.16-0k2.8, 2.0.5.16-0k2.9, 2.0.5.16-0k2.10, 2.0.5.16-0k2.11, 2.0.5.16-0k2.12, 2.0.5.16-0k2.13, 2.0.5.16-0k2.14, 2.0.5.16-0k2.15, 2.0.5.16-0k2.16, 2.0.5.16-0k2.17, 2.0.5.16-0k2.18, 2.0.5.16-0k2.19, 2.0.5.16-0k2.20, 2.0.5.16-0k2.21, 2.0.5.16-0k2.22, 2.0.5.16-0k2.23, 2.0.5.16-0k2.24, 2.0.5.16-0k2.25, 2.0.5.16-0k2.26, 2.0.5.16-0k2.27, 2.0.5.16-0k2.28, 2.0.5.16-0k2.29, 2.0.5.16-0k2.30, 2.0.5.16-0k2.31, 2.0.5.16-0k2.32, 2.0.5.16-0k2.33

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2023-12-24T23:31:04.019Z
• Last modified: 2024-08-28T14:21:49.923Z

09References

• vuldb.com — https://vuldb.com/?id.248940
• vuldb.com — https://vuldb.com/?ctiid.248940
• note.zhaoj.in — https://note.zhaoj.in/share/L1hGe9BDlbnt