CVE-2024-37023

Vonets WiFi Bridges Command Injection

CVSS 9.4 CRITICALEPSS 1.3%CWE-77

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.4EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 Aug 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters.

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Affected products

Vonets · VAP11AC Vonets · VAP11G Vonets · VAP11G-300 Vonets · VAP11G-500 Vonets · VAP11G-500S Vonets · VAP11N-300 Vonets · VAP11S Vonets · VAP11S-5G Vonets · VAR11N-300 Vonets · VAR1200-H Vonets · VAR1200-L Vonets · VAR600-H Vonets · VBG1200 Vonets · VGA-1000

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08