CVE-2023-42495: Critical Command Injection in Dasan Networks W-Web

CVE-2023-42495 describes a command injection flaw in Dasan Networks W-Web software, versions 1.22 through 1.27. It is a failure to neutralize special elements (CWE-78) used in operating system commands. The vulnerability allows an attacker to execute arbitrary commands with the privileges of the process managing W-Web, directly impacting administrators of Dasan access and gateway appliances.

The CVSS score is 9.8, classified as critical by the National Vulnerability Database. The vulnerability was made public on 13 December 2023 and remains current: on 30 October 2026, a signal of a public repository on GitHub emerged declaring to contain material related to this flaw. This does not automatically mean that exploit code is freely available, but it indicates renewed interest from the research community in the vulnerability.

Infrastructure management teams must immediately verify whether they have instances of Dasan Networks W-Web in versions 1.22-1.27 in production or test environments. Contact the vendor for available patched versions and plan the update according to their guidelines. In the meantime, implement network access filters that limit appliance exposure to trusted administrative hosts only. If the appliance is not essential, isolate it from the network until patches become available.