CVE-2023-5142

A vulnerability classified as problematic was found in H3C GR-1100-P, GR-1108-P, GR-1200W, GR-1800AX, GR-2200, GR-3200, GR-5200, GR-8300, ER2100n, ER2200G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2 and ER6300G2 up to 20230908. This vulnerability affects unknown code of the file /userLogin.asp of the component Config File Handler. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. VDB-240238 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-22
• CWE-22

• https://github.com/CJCniubi666/H3C-ER/blob/main/README.mdExploit, Third Party Advisory
• https://github.com/yinsel/CVE-H3C-ReportExploit, Third Party Advisory
• https://vuldb.com/?ctiid.240238Permissions Required, Third Party Advisory
• https://vuldb.com/?id.240238Third Party Advisory
• https://github.com/CJCniubi666/H3C-ER/blob/main/README.mdExploit, Third Party Advisory
• https://github.com/yinsel/CVE-H3C-ReportExploit, Third Party Advisory
• https://vuldb.com/?ctiid.240238Permissions Required, Third Party Advisory
• https://vuldb.com/?id.240238Third Party Advisory

Published

Sep 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51414Deserialization of Untrusted Data vulnerability in EnvialoSi…9.8
• CVE-2023-51415Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2023-51416Cross-Site Request Forgery (CSRF) vulnerability in EnvialoSi…6.5
• CVE-2023-51417Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8
• CVE-2023-51418Missing Authorization vulnerability in Joris van Montfort JV…7.7
• CVE-2023-51419Unrestricted Upload of File with Dangerous Type vulnerabilit…9.8
• CVE-2023-51420Improper Control of Generation of Code ('Code Injection') vu…8.8
• CVE-2023-51421Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8
• CVE-2023-51422Deserialization of Untrusted Data vulnerability in Saleswond…8.8
• CVE-2023-51423Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-51424Improper Privilege Management vulnerability in Saleswonder T…9.8
• CVE-2023-51425Improper Privilege Management vulnerability in Jacques Malgr…9.8