CVE-2023-37265

Name of the Vulnerable Software and Affected Versions CasaOS versions prior to 0.4.4

Description CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, an unauthenticated attacker can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses.

Recommendations For versions prior to 0.4.4, upgrade to CasaOS 0.4.4. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.