CVE-2024-53939

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53939
An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/Dual_freq_un_apple endpoint is vulnerable to command injection through the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute arbitrary commands on the device (with root-level permissions) via crafted input.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/actuator/cve/blob/main/Victure/CVE-2024-53939.txt
https://github.com/actuator/cve/blob/main/Victure/RX1800-EN_V1.0.0_r12_110933-CMD-INJ-WIFI-SHELL.gif
https://github.com/actuator/cve/blob/main/Victure/Victure_RX1800_Security_Report.pdf
Configurations

No configuration.

History

03 Dec 2024, 19:15

Type Values Removed Values Added
CWE CWE-78
Summary
  • (es) Se descubrió un problema en los dispositivos Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0). El endpoint /cgi-bin/luci/admin/opsw/Dual_freq_un_apple es vulnerable a la inyección de comandos a través de los parámetros de nombre de 2,4 GHz y 5 GHz, lo que permite que un atacante ejecute comandos arbitrarios en el dispositivo (con permisos de nivel root) a través de una entrada manipulada.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

02 Dec 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-02 22:15

Updated : 2024-12-03 19:15

NVD link : CVE-2024-53939

Mitre link : CVE-2024-53939

CVE.ORG link : CVE-2024-53939

JSON object : View

Products Affected

No product.

CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')