CVE-2023-0011 [High] | Input Validation Bypass in Toby-L200 Firmware

A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial interface to send malicious AT commands. Exploitation of the vulnerability gives full administrative (root) privileges to the attacker to execute any operating system command on TOBY-L2 which can lead to modification of the behavior of the module itself as well as the components connected with it (depending on its rights on other connected systems). It can further provide the ability to read system level files and hamper the availability of the module as well.. This issue affects TOBY-L2 series: TOBY-L200, TOBY-L201, TOBY-L210, TOBY-L220, TOBY-L280.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.06%	0.48%	+0.43%
2	2025-03-19	0.04%	0.06%	+0.01%
3	2025-03-17	—	0.04%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.06%

0.48%

+0.43%

2025-03-19

0.04%

0.06%

+0.01%

2025-03-17

—

0.04%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.6	3.1	HIGH	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H` Click to expand Attack vector (AV:P) Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.9	6.0	[email protected]
6.8	3.1	MEDIUM	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:P) Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	0.9	5.9	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.6

3.1

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Click to expand

Attack vector (AV:P): Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.9

6.0

[email protected]

6.8

3.1

MEDIUM

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:P): Hands-on access—USB, keyboard, opening the case—not something you do purely over the wire.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

0.9

5.9

[email protected]

Affected software / configurations for CVE-2023-0011

Vendor	Product	Version	Raw CPE
u-blox	toby-l200_firmware	—	cpe:2.3:o:u-blox:toby-l200_firmware:-:::::::*
u-blox	toby-l201_firmware	—	cpe:2.3:o:u-blox:toby-l201_firmware:-:::::::*
u-blox	toby-l210_firmware	—	cpe:2.3:o:u-blox:toby-l210_firmware:-:::::::*
u-blox	toby-l220_firmware	—	cpe:2.3:o:u-blox:toby-l220_firmware:-:::::::*
u-blox	toby-l280_firmware	—	cpe:2.3:o:u-blox:toby-l280_firmware:-:::::::*

References for CVE-2023-0011

URL	Tags
https://www.u-blox.com/en/report-security-issues	Vendor Advisory

URL

CVE-2023-0011 | Command Execution through Serial Interface of u-blox TOBY-L2

Exploit prediction scoring system (EPSS) score for CVE-2023-0011

Common vulnerability scoring system (CVSS) metrics for CVE-2023-0011

Weakness enumeration for CVE-2023-0011

Affected software / configurations for CVE-2023-0011

References for CVE-2023-0011