CVE Intelligence
Analysis AI-assisted

CVE-2023-54342: Eclipse Equinox OSGi Console Unauthenticated Remote Code Execution

CVE-2023-54342 affects Eclipse Equinox OSGi versions 3.8 through 3.18 and is described as an unauthenticated remote code execution flaw in the console interface (CWE-306). The CVSS 3.1 base score is 9.8 (critical), as published by VulnCheck. The record shows no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2023-54342 is a remote code execution weakness (CWE-306, missing authentication for a critical function) in the console interface of Eclipse Equinox OSGi. The record states that versions 3.8 through 3.18 are affected. The score was published by VulnCheck with a CVSS 3.1 base score of 9.8.

Impact

  • According to the record, an unauthenticated attacker who can reach the console over the network may run arbitrary code on the host.
  • The reported CVSS 3.1 vector (AV:N, PR:N, UI:N, S:U, C:H, I:H, A:H) indicates a network-reachable attack requiring no privileges or user interaction, with high impact to confidentiality, integrity and availability.
  • VulnCheck also lists a CVSS 4.0 score of 9.3.

Affected products and versions

  • Eclipse Equinox OSGi, versions 3.8 through 3.18, as stated in the description.
  • The record's affected list is empty, so exact version boundaries and product packaging should be confirmed against Eclipse Foundation or distributor advisories.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • The references include an Exploit-DB entry and a VulnCheck advisory, which shows public exploit material exists. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • The record lists no fixed version. Check the Eclipse Foundation and the vendors of any OSGi-based product you run for patched releases.
  • Do not expose OSGi console interfaces to untrusted networks, and restrict access to administrative hosts using segmentation and firewall rules.
  • Inventory applications and embedded runtimes that bundle Equinox OSGi, since the component may not be obvious.

Detection guidance

  • Monitor for unexpected inbound connections to OSGi console ports from networks that should not reach them.
  • Review logs for console activity not tied to known administrators, and watch for unexpected class loading or outbound connections from the runtime process.
  • Investigate unusual outbound connections initiated by application servers as a potential indicator of compromise.

Limitations of the available information

  • The record contains no affected or fixed version list and cites no vendor advisory.
  • The record's publication date (2026) does not match the year in the CVE identifier; verify dates with the CVE Program.
  • The EPSS probability of 0.00455 is a modelled estimate and is not evidence of exploitation.
  • Whether versions outside 3.8 to 3.18 are affected is unknown.

Frequently asked questions

Which versions of Eclipse Equinox OSGi are affected by CVE-2023-54342?

The record's description states that versions 3.8 through 3.18 are affected. The affected product list in the record is empty, so confirm exact boundaries with vendor advisories.

Is CVE-2023-54342 being exploited in the wild?

The record shows no CISA KEV listing, and no confirmed in-the-wild exploitation appears in the sources consulted. The references include a public Exploit-DB entry, so treat exposed consoles as high priority.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.