CVE-2023-5457 is a high severity (CVSS 7.5) flaw in the AiLux imx6 bundle, where the Django web application runs with its debug setting turned on. A remote, unauthenticated attacker may read sensitive resources on the device. Nozomi Networks says to update to imx6_1.0.7-2.
What's affected
- Product: AiLux imx6 bundle.
- Affected: versions below imx6_1.0.7-2.
- Fixed: imx6_1.0.7-2, per the Nozomi Networks advisory.
- Severity: 7.5 High in both the NVD record and the advisory (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), a confidentiality only impact.
- Reporter credited by Nozomi: Andrea Palanca of Nozomi Networks.
How to check if you're exposed
Check the installed bundle version against imx6_1.0.7-2 using the device interface or vendor tooling. The advisory gives no command for reading it.
For your own Django applications, the same class of mistake is easy to test. Confirm that debug is off in the deployed settings, and that a deliberately bad URL returns a plain error page instead of a detailed one. This check is safe to run against your own services:
python manage.py check --deploy
The deploy check flags a debug setting that is on. It does not replace the vendor update for the imx6 bundle, because the setting there ships inside the product.
What to do now
- Update the imx6 bundle to imx6_1.0.7-2 or later.
- Limit network reach to the device to a management segment until the update is applied.
- If your own Django apps are deployed, run the deploy check in CI and fail the build when debug is on.
- Review what a debug page could have exposed on affected devices, such as settings, paths and stack traces, and rotate any secrets that appeared there.
- Add the product and version to your asset inventory.
Why it matters
Django's debug mode is meant for development. When it is on, an error page can show configuration values, installed apps, file paths and request details. That helps a developer and helps an attacker even more. The record classes this as CWE-1269, a product released in a non-release configuration, which is a shipping mistake and not a coding bug in Django itself.
The lesson reaches beyond this one product. Secure defaults need to be checked in the built artifact, not assumed from the source tree. The record does not list this CVE as known exploited.
Quick check
Is Django itself vulnerable?
No. The flaw is the debug setting being on in the shipped configuration of the AiLux bundle. Django behaves as documented when debug is enabled.
Sources
Last reviewed: 19 October 2026.
