Vulnerability record · CVE-2023-37469 · published 24 August 2023

CVE-2023-37469: Icewhale casaos command injection vulnerability

IIcewhale · Casaos

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

8.8 CVSS 3.1 High EPSS 1.6% · top 25.5% CWE-77 · Command injection

8.8CVSS 3.1 base score

1.6%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

10References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

ICasaos Icewhale

References

Link	Tags
https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121	Product
https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58	Product
https://github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47c	Patch
https://github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4	Release Notes
https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/	ExploitThird Party Advisory
https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121	Product
https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58	Product
https://github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47c	Patch
https://github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4	Release Notes
https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/	ExploitThird Party Advisory

Track CVE-2023-37469 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-24765Icewhale casaos information exposure vulnerabilityCasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files …EPSS 0.97%6 Mar 2024 9.8CVE-2024-24767Icewhale casaos improper restriction of authentication attempts vulnerabilityCasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend …EPSS 0.98%6 Mar 2024 9.8CVE-2023-37265Icewhale casaos missing authentication for critical function vulnerabilityCasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands …EPSS 7.4%17 Jul 2023 9.8CVE-2023-37266Icewhale casaos improper authentication vulnerabilityCasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentic…EPSS 6.8%17 Jul 2023 9.8CVE-2022-24193Icewhale casaos os command injection vulnerabilityCasaOS before v0.2.7 was discovered to contain a command injection vulnerability.EPSS 5.5%10 Mar 2022 6.9CVE-2025-34171Icewhale casaos missing authorization vulnerabilityCasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration …EPSS 0.64%2 Jan 2026 9.8CVE-2026-8037Progress LoadMaster API OS Command Injection RCEProgress LoadMaster (and related ADC products) contain an OS command injection flaw in multiple API command endpoints where unsanitized input is pass…KEVEPSS 77%analysed4 Jun 2026 8.7CVE-2026-42271LiteLLM MCP test endpoints allow authenticated OS command injectionLiteLLM versions 1.74.2 through before 1.83.7 expose two MCP preview endpoints (POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list) th…KEVEPSS 13%analysed8 May 2026

Source: NIST National Vulnerability Database (record CVE-2023-37469), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.