CVE-2024-11013

Description

Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.

Reserved 2024-11-08 | Published 2024-11-29 | Updated 2024-11-29 | Assigner NEC

Problem types

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

Default status
unknown

from Ver9.2 to Ver10.10.21
affected

Default status
unknown

for Ver10.8 up to Ver10.8.27
affected

Default status
unknown

for Ver10.9 up to Ver10.9.14
affected

Default status
unknown

Ver1.2.15 and earlier
affected

Credits

RyotaK of Flatt Security Inc. reporter

References

https//jpn.nec.com/security-info/secinfo/nv24-009_en.html

cve.org (CVE-2024-11013)

nvd.nist.gov (CVE-2024-11013)

Download JSON