CVE-2024-22182

Published: Mar 1, 2024Modified: Jun 17, 2026Deferred

8.6

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Exploitability: 3.9 / Impact: 4.7

Source: ics-cert@hq.dhs.gov (Secondary)

Description

A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interrupting service.

Related CWEs

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References (4)

https://clibrary-online.commend.com/en/cyber-security/security-advisories.html

Source: ics-cert@hq.dhs.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01

Source: ics-cert@hq.dhs.gov

https://clibrary-online.commend.com/en/cyber-security/security-advisories.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.cisa.gov/news-events/ics-advisories/icsa-24-051-01

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.