CVE-2024-40112

Katalog CVE

CVSS 5.9 · Medium EPSS 0,50%

Kerentanan Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') pada sitecom wlx-2006 firmware. Skor CVSS 3.1 5.9 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A Local File Inclusion (LFI) vulnerability exists in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before, which allows an attacker to manipulate the "language" cookie to include arbitrary files from the server. This vulnerability can be exploited to disclose sensitive information.

Rincian

Terbit di NVD

2 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.9 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Emm448/vulnerability-research/tree/main/CVE-2024-40112 exploit · advisory pihak ketiga
• http://www.sitecomlearningcentre.com/products/wlx-2006v1001/wi-fi-range-extender-n300/downloads broken link