OS Command Injection in RecoverPoint for VMs - CVE-2024-22426
Published: January 16, 2025
Vulnerability identifier: #VU102867
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-22426
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.
Affected software
RecoverPoint for VMs
How to mitigate CVE-2024-22426
Install updates from vendor's website.
RecoverPoint for VMs - update to 6.0.SP1.P1