CVE-2023-35762

CRITICAL

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.

Affects 2 products across 1 vendor.

BCS7.13
CVSS 3.19.8
EPSS1.7%
Percentile75th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to OS command injection, which could allow remote code execution, leading to potential unauthorized access and control of the device.

BSID: BS-2023-GLOBAL-054261-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-35762?
Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to OS command injection, which could allow remote code execution, leading to potential unauthorized access and control of the device.
What is the CVSS score for CVE-2023-35762?
CVE-2023-35762 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.7%.
Is CVE-2023-35762 actively exploited?
No confirmed active exploitation of CVE-2023-35762 as of 2026-05-30.
How do I remediate CVE-2023-35762?
Priority: IMMEDIATE. Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-304-02
What systems are affected by CVE-2023-35762?
CVE-2023-35762 affects: Inea, Inea.
Vulnerability Details
CVE IDCVE-2023-35762
BSIDBS-2023-GLOBAL-054261-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2023-11-20
Last Modified2024-11-21
ICS Relevance25%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker could exploit this vulnerability by injecting malicious OS commands through a vulnerable input field, potentially leading to remote code execution on the device.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Inea Me Rtu Firmware —
Inea Me Rtu —
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Threat Intelligence
● Threat Intelligence Validated: July 2026 | Threat Age: 978 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash549f85bc4c748ca2cb5697851e4922a2fad4f8a233406ec57fad37697fc27afab51db7e1721520ce1beb7372740f8909cd0e94261709aba3f0a1782eae1984d5
Related CVEs affecting Inea
CVE-2023-29155 9.8 Versions of INEA ME RTU firmware 3.36b and prior do not require authenticatio... CVE-2019-14926 9.8 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices thr... CVE-2019-14930 9.8 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices thr... CVE-2019-14931 9.8 An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices thr... CVE-2023-2131 9.8 Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command i...
View all Inea CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →