CVE-2024-37569

Katalog CVE

CVSS 8.8 · High EPSS 3,2%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada mitel 6869i sip firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter.

Rincian

Terbit di NVD

9 Juni 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis exploit · advisory pihak ketiga
• https://www.youtube.com/watch?v=I9TQqfP5qzM exploit
• https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py product