PatchTheCVECVE-2023-33374: Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management plat
CVE-2023-33374 is a critical-severity flaw (CVSS 9.8) affecting connected io. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote command execution.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.3% (top 29%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2023-08-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-33374?
connected io: upgrade to newer than 2.1.0. Exact commands for each OS are on this page.
Is CVE-2023-33374 being exploited?
CVE-2023-33374 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-33374 affect?
CVE-2023-33374 affects connected io. Severity is critical (CVSS 9.8). Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices
How urgent is CVE-2023-33374?
Priority 57/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-33378 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communi
- CVE-2023-33377 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of
- CVE-2023-33376 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its c
- CVE-2023-33375 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, e
- CVE-2023-33373 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfi