CVE-2024-28136 | THREATINT

Assigner	CERTVDE
Reserved	2024-03-05
Published	2024-05-14
Updated	2024-08-02

Description

A local attacker with low privileges can use a command injection vulnerability to gain root privileges due to improper input validation using the OCPP Remote service.

HIGH: 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-20 Improper Input Validation

Product status

Default status

0x40029b2b10

Any version

affected

Default status

0x40029b2b60

Any version

affected

Default status

0x40029b2bb0

Any version

affected

Default status

0x40029b2c00

Any version

affected

Credits

Trend Micro's Zero Day Initiative 0x40029b2c50

@ByteInsight 0x40029b2c70

References

https://cert.vde.com/en/advisories/VDE-2024-019

cve.org CVE-2024-28136

nvd.nist.gov CVE-2024-28136

Download JSON

https://cve.threatint.com/CVE/CVE-2024-28136

Subscribe to our newsletter to learn more about our work.