CVE-2023-54329: Inbit Messenger

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.

Affected products

• Inbit Inbit Messenger: from 4.6.0, up to and including 4.9.0

Published 2026-01-13. Last modified 2026-06-17.