CVE-2023-5684: Byzoro Smart S85F Management Platform importexport.php OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication required, public exploit code, and very high EPSS make this an urgent risk for any exposed Smart S85F device.

What it is

Byzoro Smart S85F Management Platform (up to 20231012) contains an OS command injection flaw in the /importexport.php file. The vulnerability is rated critical and can be triggered remotely without authentication, allowing arbitrary command execution on the device. The vendor was contacted but did not respond, so no official fix is known.

Impact

An unauthenticated remote attacker can execute arbitrary operating system commands on the management platform, gaining full control of the device with high confidentiality, integrity and availability impact. This could allow configuration tampering, data theft, or use of the device as a pivot into the network.

Attack surface

The flaw is reached over the network via the /importexport.php endpoint of the web management interface. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

A public exploit has been disclosed (reference tagged Exploit) and EPSS is very high at 0.784 (99.6th percentile), though the CVE is not listed in CISA KEV. No ransomware usage is documented.

What to do

• Apply any vendor patch or firmware update for Smart S85F if one becomes available; the vendor did not respond to the disclosure, so verify current firmware status directly.
• Restrict network access to the management interface so /importexport.php is not reachable from untrusted networks; place it behind a firewall or VPN.
• Disable or block the import/export functionality if it is not required for operations.
• Monitor and audit the device for unexpected command execution or configuration changes, and consider replacing the device if no fix is forthcoming.

Detection

• Inspect web server or device logs for requests to /importexport.php, especially with unusual parameters or command-like payloads.
• Monitor for unexpected outbound connections or process execution on the device that could indicate command injection.
• Alert on anomalous configuration changes or file imports/exports on the management platform.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.