CVE-2023-45597 is a medium severity CSV formula injection flaw, scored 5.9, in the export_file function of the AiLux imx6 web application. A remote authenticated attacker can plant formulas in generated CSV files. Update to imx6_1.0.7-2 or later. The harm lands on whoever opens the exported file.
What's affected
The NVD record lists the AiLux imx6 bundle below version imx6_1.0.7-2 as affected. Nozomi Networks' advisory for CVE-2023-45591, which I read, gives the fix as updating to imx6 bundle version imx6_1.0.7-2, and its mitigations section is empty. The record for this CVE uses the same version boundary.
This is one of six CVEs in the same bundle that share the version boundary and the fix. The related records in this range are CVE-2023-45591, CVE-2023-45592, CVE-2023-45595, CVE-2023-45597, CVE-2023-45599 and CVE-2023-45600.
How to check if you're exposed
AiLux imx6 is a bundle for networked camera and edge devices. The version appears in the device's web interface or in the vendor's firmware information. The exact location depends on the device, so use the vendor's documentation.
If you operate these devices, record the bundle version for each and compare it with imx6_1.0.7-2. Anything below that version is in scope. Devices that cannot be updated should be kept off untrusted networks, and the web interface should not be reachable from the internet.
What to do now
- Identify devices that run the AiLux imx6 bundle and note the bundle version of each.
- Update to imx6_1.0.7-2 or later, as the vendor advisory directs.
- Restrict access to the device web interface to a management network.
- Review web interface accounts and remove any that are not needed.
- Confirm the version after the update and keep the record.
Why it matters
The weakness is improper neutralization of formula elements in a CSV file, CWE-1236. A spreadsheet program can treat a cell that starts with an equals sign or similar character as a formula. If the exporting application does not neutralize such values, whoever opens the file may run something they did not expect.
The vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The user interaction requirement is the person who opens the export. The harm happens on the analyst's machine, not on the device.
The CVE is not on the CISA KEV list. Until you update, treat exports from the device as untrusted input: open them in a viewer that does not evaluate formulas, or import them as plain text.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Where does the harm happen?
On the machine of whoever opens the exported CSV, which is why the vector needs user interaction.
What is the fix?
Update the bundle to imx6_1.0.7-2 or later.
Sources
- Nozomi Networks advisory for CVE-2023-45591
- Nozomi Networks advisory for CVE-2023-45597, listed in the NVD record
- NVD record data for CVE-2023-45597
Last reviewed: 19 October 2026.
