CVE-2023-33294

An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns proper CORS headers, it's accessible to all websites via the browser. At a bare minimum, this allows an attacker to retrieve a list of the user's installed apps, notifications, and downloads. It also allows an attacker to delete local files and modify system properties including the boolean persist.moz.killswitch property (which would render the device inoperable). This vulnerability is partially mitigated by SELinux which prevents reads, writes, or modifications to files or permissions within protected partitions.

• CWE-77

• https://kaios.dev/cve/1411380Exploit, Vendor Advisory
• https://kaios.dev/cve/1411380Exploit, Vendor Advisory

Published

May 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-33288An issue was discovered in the Linux kernel before 6.2.9. A …4.7
• CVE-2023-33289The urlnorm crate through 0.1.4 for Rust allows Regular Expr…7.5
• CVE-2023-3329SpiderControl SCADA Webserver versions 2.08 and prior are vu…6.5
• CVE-2023-33290The git-url-parse crate through 0.4.4 for Rust allows Regula…7.5
• CVE-2023-33291In ebankIT 6, the public endpoints /public/token/Email/gener…7.4
• CVE-2023-33293An issue was discovered in KaiOS 3.0 and 3.1. The binary /sy…5.3
• CVE-2023-33295Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered…6.5
• CVE-2023-33297Bitcoin Core before 24.1, when debug mode is not used, allow…7.5
• CVE-2023-33298com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on m…7.8
• CVE-2023-33299A deserialization of untrusted data in Fortinet FortiNAC bel…9.8
• CVE-2023-3330Improper Limitation of a Pathname to a Restricted Directory …4.3
• CVE-2023-33300A improper neutralization of special elements used in a comm…5.3