Title: Inbit Messenger 4.9.0 - Unauthenticated Remote Command Execution (RCE) Severity: Critical Date: January 13, 2026 Affected: Inbit Messenger <= 4.9.0 CVE ID: CVE-2023-54329 CWE ID: CWE-121 Stack-based Buffer Overflow CVSS Score: 9.8 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) References: - ExploitDB-51127 - Archived Software Download Page - Exploit Write-Up Credit: a-rey Description: Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by exploiting a stack overflow in the messenger's protocol. Attackers can send specially crafted XML packets to port 10883 with a malicious payload to trigger the vulnerability and execute commands with system privileges.