PatchTheCVECVE-2023-42419: Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27,
CVE-2023-42419 is a low-severity flaw (CVSS 3.8) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the server. The issue was resolved in version 2.28. Earlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world re
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 3.8 (Low) |
| Attack vector | Local |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | Required |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Published | 2024-03-05 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-42419?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2023-42419 being exploited?
CVE-2023-42419 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-42419 affect?
CVE-2023-42419 affects affected software. Severity is low (CVSS 3.8). Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key. An attacker with administrative privileges & access to the air-gapped
How urgent is CVE-2023-42419?
Priority 14/100. No elevated risk signals yet.