CVE-2024-4999

A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.

CVSS

No CVSS.

References

Link	Resource
https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/
https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/

Configurations

No configuration.

History

21 Nov 2024, 09:44

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la interfaz de administración basada en web de múltiples dispositivos Ligowave podría permitir que un atacante remoto autenticado ejecute comandos arbitrarios con privilegios elevados. Este problema afecta a UNITY: hasta 6.95-2; PRO: hasta 6.95-1.Rt3883; MIMO: hasta 6.95-1.Rt2880; APC Propeller: hasta 2-5.95-4.Rt3352.
References	~~() https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/ -~~	() https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/ -

16 May 2024, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-05-16 13:15

Updated : 2024-11-21 09:44

NVD link : CVE-2024-4999

Mitre link : CVE-2024-4999

CVE.ORG link : CVE-2024-4999

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-4999", "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "research@onekey.com", "cvssData": {"safety": "NEGLIGIBLE", "version": "4.0", "recovery": "USER", "baseScore": 9.4, "automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "DIFFUSE", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "AMBER", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "HIGH", "vulnerableSystemIntegrity": "HIGH", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "subsequentSystemAvailability": "HIGH", "vulnerableSystemAvailability": "HIGH", "subsequentSystemConfidentiality": "HIGH", "vulnerableSystemConfidentiality": "HIGH", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-05-16T13:15:48.357", "references": [{"url": "https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/", "source": "research@onekey.com"}, {"url": "https://onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "research@onekey.com", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote\u00a0attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de m\u00faltiples dispositivos Ligowave podr\u00eda permitir que un atacante remoto autenticado ejecute comandos arbitrarios con privilegios elevados. Este problema afecta a UNITY: hasta 6.95-2; PRO: hasta 6.95-1.Rt3883; MIMO: hasta 6.95-1.Rt2880; APC Propeller: hasta 2-5.95-4.Rt3352."}], "lastModified": "2024-11-21T09:44:01.143", "sourceIdentifier": "research@onekey.com"}