Command Injection in Vonets products - CVE-2024-37023
Published: August 2, 2024
Vulnerability identifier: #VU95158
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-37023
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Vonets
Affected software:
VAR1200-H
VAR1200-L
VAR600-H
VAP11AC
VAP11G-500S
VBG1200
VAP11S-5G
VAP11S
VAR11N-300
VAP11G-300
VAP11N-300
VAP11G
VAP11G-500
VGA-1000
VAR1200-H
VAR1200-L
VAR600-H
VAP11AC
VAP11G-500S
VBG1200
VAP11S-5G
VAP11S
VAR11N-300
VAP11G-300
VAP11N-300
VAP11G
VAP11G-500
VGA-1000
Detailed vulnerability description
The vulnerability allows a remote user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2024-37023
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.