CVE-2024-4163

Katalog CVE

CVSS 8.0 · High EPSS 0,38%

Kerentanan Missing Authorization. Skor CVSS 3.1 8.0 (High) menurut tech.gov.sg.

Deskripsi (NVD)

The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the limited shell file exec and download functions. By replacing the /etc/passwd file with a new root user entry, the attacker was able to breakout from the limited shell and login to a unrestricted shell with root access. With the root access, the attacker will be able take full control of the IIoT Gateway.

Rincian

Terbit di NVD

26 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.0 (High), sumber tech.gov.sg
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,7% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://govtech-csg.github.io/security-advisories/2024/04/25/CVE-2024-4163.html