cve/2023/CVE-2023-49257.md

### [CVE-2023-49257](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49257)
![](https://img.shields.io/static/v1?label=Product&message=H8951-4G-ESP&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202310271149%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-732%20Incorrect%20Permission%20Assignment%20for%20Critical%20Resource&color=brighgreen)

### Description

An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/fkie-cad/nvd-json-data-feeds