← Back

CVE-2024-7470

nvd nist
Published: Aug 5, 2024Modified: Aug 6, 2024

JSON object

Loading...
5.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: CNA (Secondary)

Description

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the function sslvpn_config_mod of the file /vpn/vpn_template_style.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273563. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected (4)

Raisecom
4 products
Msg2300 Firmware
Msg2100e Firmware
Msg2200 Firmware
Msg1200 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msg2300 Firmware
Version 3.90
Running on/withPlatform Versions
Raisecom
Msg2300
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msg2100e Firmware
Version 3.90
Running on/withPlatform Versions
Raisecom
Msg2100e
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msg2200 Firmware
Version 3.90
Running on/withPlatform Versions
Raisecom
Msg2200
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msg1200 Firmware
Version 3.90
Running on/withPlatform Versions
Raisecom
Msg1200
All versions

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (4)

Source: cna@vuldb.com
Broken LinkExploitTechnical DescriptionThird Party Advisory
Source: cna@vuldb.com
Permissions RequiredThird Party AdvisoryVDB Entry
Source: cna@vuldb.com
Permissions RequiredThird Party AdvisoryVDB Entry
Source: cna@vuldb.com
Third Party AdvisoryVDB Entry

Timeline

No history available yet.