PatchTheCVECVE-2023-33376: Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its c
CVE-2023-33376 is a critical-severity flaw (CVSS 9.8) affecting connected io. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.8% (top 43%) |
| CISA exploited list | No |
| Weakness | CWE-88 |
| Published | 2023-08-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-33376?
connected io: upgrade to newer than 2.1.0. Exact commands for each OS are on this page.
Is CVE-2023-33376 being exploited?
CVE-2023-33376 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-33376 affect?
CVE-2023-33376 affects connected io. Severity is critical (CVSS 9.8). Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices.
How urgent is CVE-2023-33376?
Priority 54/100. Critical severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-33378 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communi
- CVE-2023-33377 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of
- CVE-2023-33375 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, e
- CVE-2023-33374 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management plat
- CVE-2023-33373 CRITICAL 9.8 UPGRADE Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfi