CVE-2024-4999 | THREATINT

Assigner	ONEKEY
Reserved	2024-05-16
Published	2024-05-16
Updated	2024-06-04

Description

A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.

CRITICAL: 9.4

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

Problem types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Default status

unaffected

Any version

affected

Credits

Quentin Kaiser from ONEKEY Research Labs finder

References

https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/ third-party-advisory

cve.org CVE-2024-4999

nvd.nist.gov CVE-2024-4999

Download JSON