CVE-2023-45599 is a medium severity flaw, scored 5.5, in the iec61850 functionality of the AiLux imx6 web application. It relies on the name or extension of an uploaded file, so an authenticated attacker can upload any file type. Update to imx6_1.0.7-2 or later.
What's affected
The NVD record lists the AiLux imx6 bundle below version imx6_1.0.7-2 as affected. Nozomi Networks' advisory for CVE-2023-45591, which I read, gives the fix as updating to imx6 bundle version imx6_1.0.7-2, and its mitigations section is empty. The record for this CVE uses the same version boundary.
This is one of six CVEs in the same bundle that share the version boundary and the fix. The related records in this range are CVE-2023-45591, CVE-2023-45592, CVE-2023-45595, CVE-2023-45597, CVE-2023-45599 and CVE-2023-45600.
How to check if you're exposed
AiLux imx6 is a bundle for networked camera and edge devices. The version appears in the device's web interface or in the vendor's firmware information. The exact location depends on the device, so use the vendor's documentation.
If you operate these devices, record the bundle version for each and compare it with imx6_1.0.7-2. Anything below that version is in scope. Devices that cannot be updated should be kept off untrusted networks, and the web interface should not be reachable from the internet.
What to do now
- Identify devices that run the AiLux imx6 bundle and note the bundle version of each.
- Update to imx6_1.0.7-2 or later, as the vendor advisory directs.
- Restrict access to the device web interface to a management network.
- Review web interface accounts and remove any that are not needed.
- Confirm the version after the update and keep the record.
Why it matters
The primary weakness is reliance on the file name or extension of an externally supplied file, CWE-646, with unrestricted file upload, CWE-434, also listed. A name is something the sender chooses, so a check that only looks at the extension can be fooled by a file that claims to be something it is not.
The vector is CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L. High complexity and high privileges keep it at 5.5. The feature is tied to iec61850, a protocol family used in power utility automation, so devices running it often sit in operational networks.
The CVE is not on the CISA KEV list. For operators, the network placement matters most: keep management interfaces off the shared network and update the bundle.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Quick check
Why does the file extension matter?
Because it is chosen by the uploader. A check based on the name alone does not prove what the file contains.
Is this the same as CVE-2023-45595?
They are related upload flaws in different parts of the web application, with different weakness labels.
Sources
- Nozomi Networks advisory for CVE-2023-45591
- Nozomi Networks advisory for CVE-2023-45599, listed in the NVD record
- NVD record data for CVE-2023-45599
Last reviewed: 19 October 2026.
