CVE-2023-3643: Boss Mini firmware path argument file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, a public exploit, and a very high EPSS probability make this an urgent remote file inclusion risk.

What it is

Boss Mini 1.4.0 Build 6221 contains a critical file inclusion flaw in boss/servlet/document, where manipulation of the path argument lets an attacker include unintended files. The issue is remotely reachable and a public exploit has been disclosed, so unpatched internet-facing instances are at immediate risk.

Impact

An attacker can read or include files outside the intended document scope, potentially exposing sensitive data or enabling further code execution depending on server configuration. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

The flaw is reached over the network via the boss/servlet/document endpoint by supplying a crafted path argument. The CVSS vector shows no privileges or user interaction required (PR:N, UI:N).

Exploitation

A public exploit is referenced and EPSS is very high at 0.75363 (99.49th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.

What to do

• Apply the vendor fix for Boss Mini 1.4.0 Build 6221 or upgrade to a patched release as soon as one is available.
• Restrict network access to the boss/servlet/document endpoint to trusted management networks only.
• Validate and canonicalize the path parameter, rejecting traversal sequences and absolute paths.
• Run the Boss Mini service with least privilege and confine it to a directory with no sensitive files.
• Monitor vendor and VDB-233889 advisories for updated remediation guidance.

Detection

• Inspect web logs for requests to boss/servlet/document with path parameters containing ../, encoded traversal, or absolute file paths.
• Alert on unusual file reads or errors from the Boss Mini process that reference files outside its expected document directory.
• Correlate outbound or internal access to the Boss Mini management interface from unexpected source IPs.
• Search for known public exploit payload patterns against the document servlet in IDS/IPS or WAF telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.