PatchTheCVECVE-2023-33294: An issue was discovered in KaiOS 3.0 before 3.1
CVE-2023-33294 is a critical-severity flaw (CVSS 9.8) affecting kaios. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns proper CORS headers, it's accessible to all websites via the browser. At a bare minimum, this allows an attacker to retrieve a list of the user's insta
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.9% (top 39%) |
| CISA exploited list | No |
| Weakness | CWE-77 |
| Published | 2023-05-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-33294?
kaios: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2023-33294 being exploited?
CVE-2023-33294 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-33294 affect?
CVE-2023-33294 affects kaios. Severity is critical (CVSS 9.8). An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Beca
How urgent is CVE-2023-33294?
Priority 59/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-33293 MEDIUM 5.3 MITIGATE An issue was discovered in KaiOS 3.0 and 3.1