CVE-2023-54329
Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE)
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.
| CWE | CWE-121 |
| Vendor | inbit |
| Product | inbit messenger |
| Published | Jan 13, 2026 |
| Last Updated | Mar 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for inbit inbit messenger
Be the first to know when new critical vulnerabilities affecting inbit inbit messenger are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Inbit / Inbit Messenger
4.6.0 ≤ 4.9.0
References
exploit-db.com: https://www.exploit-db.com/exploits/51127 web.archive.org: https://web.archive.org/web/20200122082432/https://www.softsea.com/review/Inbit-Messenger-Basic-Edition.html github.com: https://github.com/a-rey/exploits/blob/main/writeups/Inbit_Messenger/v4.6.0/writeup.md vulncheck.com: https://www.vulncheck.com/advisories/inbit-messenger-unauthenticated-remote-command-execution-rce
Credits
a-rey