CVE-2023-37469

CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue.

• CWE-77

• https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121Product
• https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58Product
• https://github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47cPatch
• https://github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4Release Notes
• https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/Exploit, Third Party Advisory
• https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/route/v1/samba.go#L121Product
• https://github.com/IceWhaleTech/CasaOS/blob/96e92842357230098c771bc41fd3baf46189b859/service/connections.go#L58Product
• https://github.com/IceWhaleTech/CasaOS/commit/af440eac5563644854ff33f72041e52d3fd1f47cPatch
• https://github.com/IceWhaleTech/CasaOS/releases/tag/v0.4.4Release Notes
• https://securitylab.github.com/advisories/GHSL-2022-119_CasaOS/Exploit, Third Party Advisory

Published

Aug 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-37462XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-37463cmark-gfm is an extended version of the C reference implemen…7.5
• CVE-2023-37464OpenIDC/cjose is a C library implementing the Javascript Obj…7.5
• CVE-2023-37466vm2 is an advanced vm/sandbox for Node.js. The library conta…10
• CVE-2023-37467Discourse is an open source discussion platform. Prior to ve…5.4
• CVE-2023-37468Feedbacksystem is a personalized feedback system for student…5.5
• CVE-2023-3747Zero Trust Administrators have the ability to disallow end u…5.5
• CVE-2023-37470Metabase is an open-source business intelligence and analyti…9.8
• CVE-2023-37471Open Access Management (OpenAM) is an access management solu…9.8
• CVE-2023-37472Knowage is an open source suite for business analytics. The …6.5
• CVE-2023-37473zenstruck/collections is a set of helpers for iterating/pagi…8.8
• CVE-2023-37474Copyparty is a portable file server. Versions prior to 1.8.2…7.5