CVE-2023-51743 affects the Skyworth CM5100 router on firmware 4.1.1.24. The Set Upstream Channel ID (UCID) field is not validated, so a logged in user can crash the device. The record rates it Medium at 6.5. CERT-In advises upgrading to firmware 4.1.1.25 or later.
What's affected
The record and the CERT-In advisory both name one product: the Skyworth CM5100 router (a cable modem router) running firmware 4.1.1.24. The CERT-In note says the fix is to upgrade to version 4.1.1.25 or later. The record does not list a fixed version of its own, so treat the CERT-In figure as the one to verify against Skyworth or your service provider.
The record gives a CVSS score of 6.5 (Medium). The CVSS vector reads as follows. The attack can be reached over the network, and the complexity is low. A low-privilege account is needed. No user interaction is required. Impact on confidentiality is none, on integrity none, and on availability high. The weakness class is CWE-787.
How to check if you're exposed
Log in to the device's own web interface from a trusted wired connection and read the firmware version on the status or system information page. If it says 4.1.1.24, you are on the affected build. If you manage many devices, pull the firmware field from your asset inventory or provisioning system instead of visiting each one.
This is a hardware and firmware issue, so a package scanner will not see it. If the router was supplied by an internet provider, the provider may control firmware updates, so ask them which version they have pushed.
What to do now
- Confirm the firmware version on every CM5100 you run or support.
- Upgrade to 4.1.1.25 or later, per the CERT-In advisory.
- Restrict who can reach the router's web interface. Keep it off the internet side and limit it to a management network or a single trusted host.
- Use a strong, unique administrator password, because this attack needs a logged in account.
- After updating, check that the device stays stable and report any crash to the vendor.
Why it matters
This CVE follows the same pattern as CVE-2023-51742, which concerns a neighbouring field. Here the vulnerable parameter is the Set Upstream Channel ID. The router does not validate what is submitted, and the record classifies the weakness as an out of bounds write that results in a denial of service.
Cable modem routers expose several tuning fields like these in their web interfaces. Each one is an input that needs checking, and when one field is missed the others are often worth a look. Two CVEs from the same advisory on the same device suggest that input validation in this interface was uneven.
For defenders the lesson is simple. Keep management interfaces on a restricted network, patch the firmware to the version the advisory names, and keep a record of which devices have been updated.
Quick check
Is this the same bug as CVE-2023-51742?
No. They are separate CVEs for two different parameters in the same web interface. They share the advisory and the fix.
Do I need to be logged in?
Yes. The record shows low privileges are required.
Sources
Last reviewed: 19 October 2026.
