CVE-2023-45595 is a medium severity unrestricted file upload flaw, scored 5.9, in the file_configuration function of the AiLux imx6 web application. An authenticated attacker can upload any type of file. Update to imx6_1.0.7-2 or later. The attacker needs a high privileged login and a user action.
What's affected
The NVD record lists the AiLux imx6 bundle below version imx6_1.0.7-2 as affected. Nozomi Networks' advisory for CVE-2023-45591, which I read, gives the fix as updating to imx6 bundle version imx6_1.0.7-2, and its mitigations section is empty. The record for this CVE uses the same version boundary.
This is one of six CVEs in the same bundle that share the version boundary and the fix. The related records in this range are CVE-2023-45591, CVE-2023-45592, CVE-2023-45595, CVE-2023-45597, CVE-2023-45599 and CVE-2023-45600.
How to check if you're exposed
AiLux imx6 is a bundle for networked camera and edge devices. The version appears in the device's web interface or in the vendor's firmware information. The exact location depends on the device, so use the vendor's documentation.
If you operate these devices, record the bundle version for each and compare it with imx6_1.0.7-2. Anything below that version is in scope. Devices that cannot be updated should be kept off untrusted networks, and the web interface should not be reachable from the internet.
What to do now
- Identify devices that run the AiLux imx6 bundle and note the bundle version of each.
- Update to imx6_1.0.7-2 or later, as the vendor advisory directs.
- Restrict access to the device web interface to a management network.
- Review web interface accounts and remove any that are not needed.
- Confirm the version after the update and keep the record.
Why it matters
The weakness is unrestricted upload of a file with a dangerous type, CWE-434. The web application accepts files without checking that their type is one the feature is meant to handle. The record says a remote authenticated attacker can put any file onto the device.
The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. It needs high privileges and a user action, and the scope changes. That is a moderate combination, which explains 5.9.
The CVE is not on the CISA KEV list. Upload handlers are worth reviewing in any web application: check the type by content, store files outside the web root, and never let the upload decide its own path.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Which privileges are needed?
The vector lists high privileges, so an administrative level account is expected.
Where is the issue?
In the file_configuration functionality of the web application, per the record.
Sources
- Nozomi Networks advisory for CVE-2023-45591
- Nozomi Networks advisory for CVE-2023-45595, listed in the NVD record
- NVD record data for CVE-2023-45595
Last reviewed: 19 October 2026.
