CVE-2023-36670: Kratosdefense Ngc Indoor Unit Firmware

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute arbitrary Linux commands as root by sending crafted TCP requests to the device.

Affected products

Published 2023-07-18. Last modified 2026-06-17.