Critical severity10.0NVD Advisory· Published Dec 5, 2023· Updated Jun 17, 2026

CVE-2023-6269

Description

An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify OpenScape products "Session Border Controller" (SBC) and "Branch", before version V10 R3.4.0, and OpenScape "BCF" before versions V10R10.12.00 and V10R11.05.02. This allows an unauthenticated attacker to gain root access to the appliance via SSH (scope change) and also bypass authentication for the administrative interface and gain access as an arbitrary (administrative) user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Atos/Unify Openscape Bcf
cpe:2.3:a:atos:unify_openscape_bcf:*:*:*:*:*:*:*:*
Range: >=10,<10r10.12.00
Atos/Unify Openscape Branch
cpe:2.3:a:atos:unify_openscape_branch:*:*:*:*:*:*:*:*
Range: >=10,<10r3.4.0
Atos/Unify Openscape Session Border Controller2 versions
cpe:2.3:a:atos:unify_openscape_session_border_controller:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:atos:unify_openscape_session_border_controller:*:*:*:*:*:*:*:*range: >=10,<10r3.4.0
- (no CPE)range: <V10 R3.4.0
Atos/Unify OpenScape Voicellm-fuzzy
Range: <V10 R3.4.0
Atos Unify/Openscape Session Border Controller (sbc)v5
Range: 0
Atos Unify/Openscape Branchv5
Range: 0

Patches

Vulnerability mechanics

References

r.sec-consult.com/unifyrootnvdExploitThird Party Advisory
networks.unify.com/security/advisories/OBSO-2310-01.pdfnvdVendor Advisory
packetstormsecurity.com/files/176194/Atos-Unify-OpenScape-Authentication-Bypass-Remote-Code-Execution.htmlnvd
seclists.org/fulldisclosure/2023/Dec/16nvd

News mentions

No linked articles in our index yet.

cvss	0.650
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000