CVE-2024-31977

Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz	Permissions Required
https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977	Third Party Advisory
https://github.com/actuator/cve/tree/main/AdTran/834-5	Broken Link
https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332
https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz	Permissions Required
https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977	Third Party Advisory
https://github.com/actuator/cve/tree/main/AdTran/834-5	Broken Link

Configurations

Configuration 1 (hide)

cpe:2.3:o:adtran:sdg_smartos:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:adtran:834-5_firmware:11.1.0.101-202106231430:*:*:*:*:*:*:*

cpe:2.3:h:adtran:834-5:-:*:*:*:*:*:*:*

History

21 Nov 2024, 09:14

Type	Values Removed	Values Added
References	~~() https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz - Permissions Required~~	() https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz - Permissions Required
References	~~() https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977 - Third Party Advisory~~	() https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977 - Third Party Advisory
References	~~() https://github.com/actuator/cve/tree/main/AdTran/834-5 - Broken Link~~	() https://github.com/actuator/cve/tree/main/AdTran/834-5 - Broken Link

03 Sep 2024, 21:15

Type	Values Removed	Values Added
References		() https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332 -
Summary	~~(en) Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.5.5.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.~~	(en) Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.

26 Jul 2024, 13:15

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8
CPE		cpe:2.3:o:adtran:834-5_firmware:11.1.0.101-202106231430:::::::* cpe:2.3:h:adtran:834-5:-:::::::* cpe:2.3:o:adtran:sdg_smartos::::::::
Summary		(es) Adtran 834-5 11.1.0.101-202106231430, y corregido a partir de la versión 12.5.5.1 de SmartOS, los dispositivos permiten la inyección de comandos del sistema operativo a través de metacaracteres de shell a la utilidad Ping o Traceroute.
First Time		Adtran 834-5 Firmware Adtran Adtran sdg Smartos Adtran 834-5
References	~~() https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz -~~	() https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz - Permissions Required
References	~~() https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977 -~~	() https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977 - Third Party Advisory
References	~~() https://github.com/actuator/cve/tree/main/AdTran/834-5 -~~	() https://github.com/actuator/cve/tree/main/AdTran/834-5 - Broken Link
CWE		CWE-78

24 Jul 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-07-24 15:15

Updated : 2024-11-21 09:14

NVD link : CVE-2024-31977

Mitre link : CVE-2024-31977

CVE.ORG link : CVE-2024-31977

JSON object : View

Products Affected

adtran

834-5_firmware
834-5
sdg_smartos

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

8.8 /10