CVE-2024-48860

{"id": "CVE-2024-48860", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2024-11-22T16:15:28.337", "references": [{"url": "https://www.qnap.com/en/security-advisory/qsa-24-44", "tags": ["Vendor Advisory"], "source": "security@qnapsecurity.com.tw"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@qnapsecurity.com.tw", "description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands.\n\nWe have already fixed the vulnerability in the following version:\nQuRouter 2.4.3.103 and later"}, {"lang": "es", "value": "Se ha informado de una vulnerabilidad de inyecci\u00f3n de comandos en el sistema operativo que afecta a varias versiones del producto. Si se explota, la vulnerabilidad podr\u00eda permitir a atacantes remotos ejecutar comandos. Ya hemos corregido la vulnerabilidad en la siguiente versi\u00f3n: QuRouter 2.4.3.103 y posteriores"}], "lastModified": "2025-09-24T19:09:57.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:qnap:qurouter:2.4.0.190:build_20240522:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42432B47-A274-4AC7-9E02-0D2D257A6FC5"}, {"criteria": "cpe:2.3:o:qnap:qurouter:2.4.1.172:build_20240606:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77451C56-4576-4CCC-B7FD-7C874F22C3CA"}, {"criteria": "cpe:2.3:o:qnap:qurouter:2.4.1.634:build_20240710:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18080300-EC8D-4F8E-926E-25D0119870AD"}, {"criteria": "cpe:2.3:o:qnap:qurouter:2.4.2.317:build_20240903:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B8B0134-D750-4258-A0A1-CDBD90728B01"}, {"criteria": "cpe:2.3:o:qnap:qurouter:2.4.2.538:build_20240923:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "128C912D-D659-40A7-A0C1-185552C99CDD"}], "operator": "OR"}]}], "sourceIdentifier": "security@qnapsecurity.com.tw"}