THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4999

Ligowave Unity/Pro/Mimo/APC Arbitrary Command Injection

Reserved:2024-05-16
Published:2024-05-16
Updated:2024-05-16

Description

A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.



CRITICAL: 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Problem types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Default status
unaffected

Any version
affected

Credits

Quentin Kaiser from ONEKEY Research Labs finder

References

https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/ third-party-advisory

cve.org CVE-2024-4999

nvd.nist.gov CVE-2024-4999

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4999