CVE-2023-6260 is a Critical severity (CVSS 9.0) OS command injection in Brivo ACS100 and ACS300 access control panels, in firmware from 5.2.4 up to but not including 6.2.4.3. It can bypass physical security. Brivo's release notes list firmware 6.2.4.3 as the fix, so upgrade to it.
What's affected
The NVD description gives both the range and the attack conditions.
- Affected: Brivo ACS100 and ACS300, firmware from 5.2.4 before 6.2.4.3.
- Fixed: 6.2.4.3. The record points to Brivo's firmware release notes, in a section for release 6.2.4.3. That page did not render when I fetched it, so confirm the entry there.
- Access needed: for the ACS100 the description says network adjacent access, and for the ACS300 it says physical access.
- Severity: CVSS 9.0 Critical.
The research firm Security Risk Advisors is listed in the record's references (its advisories index). I could not find a page for this CVE on that index when I fetched it, so I did not use it for details.
How to check if you're exposed
Access control panels are managed through Brivo's cloud service and local settings, so start from the Brivo account and the device list.
- List every ACS100 and ACS300 controller and the site it protects.
- Read the firmware version of each from the Brivo account's device information or the controller's own status page.
- Anything from 5.2.4 up to, but not including, 6.2.4.3 is affected. Anything older than 5.2.4 is outside the range in the record, but check with Brivo before treating it as safe.
- Record which controllers are reachable from networks that other devices or visitors can join.
The ACS100 is described as exposed to a network adjacent attacker, so the network each panel is plugged into matters as much as the firmware.
What to do now
- Upgrade every affected controller to firmware 6.2.4.3 or later following Brivo's instructions in the firmware release notes.
- Put access control panels on a dedicated network segment, away from guest networks, office desktops and other IoT devices.
- Check physical access to the ACS300 and its wiring. The description says that model needs physical access, so cabinet locks and tamper alerts matter.
- Review door event logs around the time you update, and keep a copy, so unexpected unlock events can be investigated.
- Include building systems in your vulnerability program. They often sit outside normal patching.
Why it matters
The weakness is CWE-78, improper neutralization of special elements used in an OS command. Input reaches a command that the device runs without being cleaned, so an attacker can add commands of their own. On a controller that decides whether a door opens, that is a direct route past the lock.
The record's wording is notable: the issue "bypasses physical security". Most CVEs describe loss of data or control of a server. Here the end result can be an open door. That makes the physical and network adjacency requirements the main limit on risk, and it is why network segmentation for these panels is worth doing even after the firmware is patched. The kev flag is false, and nothing I retrieved describes exploitation in the wild.
Quick check
Which firmware fixes CVE-2023-6260?
Firmware 6.2.4.3, per the NVD range and the Brivo release notes it references.
Does an attacker need to be on site?
For the ACS100 the record says network adjacent access, and for the ACS300 it says physical access. Both need proximity.
Sources
- Brivo firmware release notes, release 6.2.4.3 (listed in the record, did not render when fetched)
- SRA Labs advisories index
Last reviewed: 19 October 2026.
