CVE-2024-41153

Katalog CVE

CVSS 7.2 · High EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada hitachienergy tro610 firmware, hitachienergy tro620 firmware +1 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the write privilege intends.

Rincian

Terbit di NVD

29 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launc... advisory vendor