Security Advisory

CVE-2023-34873: MOBOTIX P3 and Mx6 Camera tcpdump Feature Authenticated Code Execution

Last updated:
  • CVE-2023-34873
Not indexed yetThis page does not yet have enough independently analysed data (no NVD CVSS/CPE assessment, and it is not in the CISA KEV catalog) to publish as a reviewed advisory, so it is marked noindex and left out of the sitemap until more data is confirmed.

CVE-2023-34873 affects the tcpdump packet-capture feature that MOBOTIX bundles into its P3 and Mx6 series camera firmware for network diagnostics: because the feature does not properly validate the input it is given, an attacker who already holds an authenticated session on the camera can use it to execute arbitrary code, turning a diagnostic convenience into a privilege-escalation path. CISA's own analysis rates the issue 8.8 on CVSS v3 and 8.7 on CVSS v4, but NVD has not yet published its own Primary score, so this page withholds a headline severity figure.

Vulnerability summary

N/A

Not yet scored

0.5%

EPSS score (FIRST)

No

CISA KEV catalog

2025-05-23

Published

Vulnerability ID: CVE-2023-34873 · Source: NVD

Affected components

ComponentCPEVersion range
MOBOTIX P3 and Mx6 series network camera firmware (tcpdump diagnostic feature)—P3 series firmware MX-V4.1.4.11 through MX-V4.4.2.73, fixed in MX-V4.7.2.18; Mx6 series firmware MX-V5.0.0.127 through MX-V5.1.0.99-r4, fixed in MX-V5.2.0.61, per CISA ICS advisory ICSA-24-235-03

What does this mean for affected devices?

CVE-2023-34873 (CWE-78, OS Command Injection) affects the tcpdump diagnostic feature built into MOBOTIX P3 and Mx6 series network camera firmware. NVD's description states: "On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated users to execute code" (NVD).

CISA's ICS advisory ICSA-24-235-03, published 22 August 2024, lists the affected firmware as P3 series MX-V4.1.4.11 through MX-V4.4.2.73 (fixed in MX-V4.7.2.18) and Mx6 series MX-V5.0.0.127 through MX-V5.1.0.99-r4 (fixed in MX-V5.2.0.61), and states that "successful exploitation of these vulnerabilities could allow an authenticated attacker to achieve remote code execution." CISA recommends applying the patched firmware and applying standard ICS network-hardening measures such as network isolation, firewalling, and VPN access for remote management (CISA ICS Advisory ICSA-24-235-03). MOBOTIX's own release notes confirm that MX-System Release 4.7.2.21 and later "contains important security updates for the cameras listed above," without detailing individual CVEs in the public release-notes page (MOBOTIX MX-System Release Notes).

NVD records only a Secondary CVSS v4.0 score of 8.7, source [email protected], vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N — not a Primary score from [email protected]. CISA's own advisory separately cites a CVSS v3 score of 8.8 and a CVSS v4 score of 8.7. Because none of these figures is NVD's own Primary analysis, this page does not present a headline CVSS score as NVD-confirmed (NVD).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00494 (42.6th percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

Operators of affected MOBOTIX P3 and Mx6 cameras should update to the fixed firmware versions and restrict access to the camera's administrative/diagnostic functions to trusted operators on isolated management networks.

How to fix this class of issueThis advisory's weakness class is Command injection. Our practical guide covers how to detect, fix, verify and disclose it: How to fix command injection in embedded firmware.

Evidence

  • On MOBOTIX P3 cameras before MX-V4.7.2.18 and Mx6 cameras before MX-V5.2.0.61, the tcpdump feature does not properly validate input, which allows authenticated users to execute code. — NVD
  • Affects P3 series firmware MX-V4.1.4.11 through MX-V4.4.2.73 (fixed MX-V4.7.2.18) and Mx6 series firmware MX-V5.0.0.127 through MX-V5.1.0.99-r4 (fixed MX-V5.2.0.61); successful exploitation could allow an authenticated attacker to achieve remote code execution. — CISA ICS Advisory ICSA-24-235-03
  • NVD records only a Secondary CVSS v4.0 score of 8.7 from source [email protected], vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; no NVD Primary score has been published as of this review. — NVD
  • Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00494 (42.6th percentile) as of 2026-11-07. — FIRST EPSS

Questions about this page?

hello@softwsp.com Chat with David on WhatsApp

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2023-39509: Bosch IP Camera Authenticated OS Command Injection — CVSS 7.2, High severityCVE-2023-39509: a command injection vulnerability in Bosch IP cameras of the CPP13 and CPP14 firmware families lets an authenticated user with administrative rights run arbitrary OS commands on the camera. NVD has published its own Primary CVSS v3.1 score of 7.2 (high), matching Bosch's own figure.CVE-2023-43959: Yealink SIP-T19P-E2 IP Phone Authenticated Command Injection via Ping Diagnostic — CVSS 8.8, High severityCVE-2023-43959: an attacker who is logged into the web interface of a Yealink SIP-T19P-E2 IP phone can inject operating-system commands through the network diagnostics ping/traceroute function and execute them with root privileges. NVD Primary CVSS 8.8; sourced to NVD, with proof-of-concept detail from independent security researchers.CVE-2024-12987: DrayTek Vigor Router Unauthenticated OS Command Injection — CVSS 9.8, Critical severityCISA KEVCVE-2024-12987: KEV unauthenticated OS command injection in the DrayTek Vigor2960/Vigor300B/Vigor3900 web management interface, full device takeover. Versions, scoring, sourced to NVD, CISA and DrayTek.

Sources

  1. NVD
  2. CISA ICS Advisory ICSA-24-235-03
  3. MOBOTIX MX-System Release Notes
  4. CISA KEV
  5. FIRST EPSS