CVE-2023-45592 is a medium severity flaw, scored 6.8, in the AiLux imx6 bundle. The embedded Chromium browser runs as root with its sandbox switched off, which magnifies any browser attack. Update to imx6_1.0.7-2 or later. Physical access to the device is the attack vector.
What's affected
The NVD record lists the AiLux imx6 bundle below version imx6_1.0.7-2 as affected. Nozomi Networks' advisory for CVE-2023-45591, which I read, gives the fix as updating to imx6 bundle version imx6_1.0.7-2, and its mitigations section is empty. The record for this CVE uses the same version boundary.
This is one of six CVEs in the same bundle that share the version boundary and the fix. The related records in this range are CVE-2023-45591, CVE-2023-45592, CVE-2023-45595, CVE-2023-45597, CVE-2023-45599 and CVE-2023-45600.
How to check if you're exposed
AiLux imx6 is a bundle for networked camera and edge devices. The version appears in the device's web interface or in the vendor's firmware information. The exact location depends on the device, so use the vendor's documentation.
If you operate these devices, record the bundle version for each and compare it with imx6_1.0.7-2. Anything below that version is in scope. Devices that cannot be updated should be kept off untrusted networks, and the web interface should not be reachable from the internet.
What to do now
- Identify devices that run the AiLux imx6 bundle and note the bundle version of each.
- Update to imx6_1.0.7-2 or later, as the vendor advisory directs.
- Restrict access to the device web interface to a management network.
- Review web interface accounts and remove any that are not needed.
- Confirm the version after the update and keep the record.
Why it matters
The weakness is execution with unnecessary privileges, CWE-250. The record says the embedded Chromium binary runs with its sandbox option disabled and with root privileges. A browser sandbox exists to contain a compromised renderer, so without it a successful browser attack gets the full rights of the process.
The vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack vector is physical, so the score reflects an attacker with hands on the device, not a remote one. That is why a flaw with such a high impact lands at 6.8.
The CVE is not on the CISA KEV list. The design lesson applies beyond this device: if an embedded product ships a browser, keep the sandbox on and run it as a low privileged user.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Why is the attack vector physical?
The record's vector uses AV:P, meaning physical access to the device is needed.
What is the fix?
The same imx6_1.0.7-2 bundle update that covers the other CVEs.
Sources
- Nozomi Networks advisory for CVE-2023-45591
- Nozomi Networks advisory for CVE-2023-45592, listed in the NVD record
- NVD record data for CVE-2023-45592
Last reviewed: 19 October 2026.
