| Assigner | Bitdefender |
| Reserved | 2023-11-27 |
| Published | 2024-05-15 |
| Updated | 2024-06-06 |
Description
A command injection vulnerability exists in the IOCTL that manages OTA updates. A specially crafted command can lead to command execution as the root user. An attacker can make authenticated requests to trigger this vulnerability.
| CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Problem types
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Product status
Any version before 4.2.10
Any version before 4.2.11
Credits
Alexandru Lazar
Radu Basaraba
References
https://bitdefender.com/blog/labs/notes-on-throughtek-kalay-vulnerabilities-and-their-impact/
