CVE-2023-54344
Published: 05 May 2026
Description
Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending payloads to the console interface. Attackers can connect to the OSGi console port and send base64-encoded bash commands…
more
wrapped in fork directives to achieve code execution and establish reverse shell connections.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific flaw in Eclipse Equinox OSGi 3.7.2 and earlier, eliminating the unauthenticated remote code execution vulnerability in the console interface.
Restricts system functionality by prohibiting or disabling the unnecessary OSGi console port, preventing exposure to unauthenticated remote command execution.
Enforces boundary protection to monitor and control network communications, blocking unauthorized access to the exposed OSGi console port.
Security SummaryAI
Eclipse Equinox OSGi versions 3.7.2 and earlier contain a remote code execution vulnerability in the console interface. This flaw, tracked as CVE-2023-54344 and published on 2026-05-05, allows attackers to execute arbitrary commands by sending specially crafted payloads. It is associated with CWE-306 (Missing Authentication for Critical Function) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility and lack of prerequisites.
Unauthenticated attackers can exploit this vulnerability by connecting to the exposed OSGi console port and transmitting base64-encoded bash commands wrapped in fork directives. Successful exploitation enables arbitrary code execution on the target system, including the establishment of reverse shell connections for persistent access and further compromise.
Advisories and related resources, including a Vulncheck advisory on the Eclipse Equinox OSGi remote code execution and an Exploit-DB entry (exploit 51879), provide details on the issue, with the latter publishing a proof-of-concept exploit. No specific patch or mitigation details are outlined in the core CVE information.
Details
- CWE(s)