CVE-2024-28025

CVSS 7.2 HIGHEPSS 7.5%CWE-78

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.2EPSS 7.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

21 Nov 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authenticated OS Command Injection that occurs through the attacker-controlled `btn1` parameter, at offset `0x8eb0`.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

MC Technologies · MC LR Router

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://talosintelligence.com/vulnerability_reports/TALOS-2024-1953 https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1953