PT-2025-50741 · Rengine · Rengine

Caner Tercan · Publicado 2025-12-11 · Atualizado 2026-01-20 · CVE-2024-58287

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions reNgine version 2.2.0

Description The software contains a command injection issue in the nmap cmd parameter within the scan engine configuration. Authenticated attackers can execute arbitrary commands by modifying the nmap cmd parameter with malicious base64-encoded payloads during scan engine configuration. This allows for remote code execution. The vulnerable parameter is nmap cmd.

Recommendations Versions prior to 2.2.0 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2024-58287

Produtos afetados

Rengine

Referências · 8

• 🔥 https://exploit-db.com/exploits/52081 · Exploit
• https://github.com/yogeshojha/rengine · Nota
• https://osv.dev/vulnerability/CVE-2024-58287 · Aviso do Fabricante
• https://t.me/cveNotify/149319 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1999332259518693657 · Publicação no Twitter
• https://rengine.wiki · Nota
• https://vulncheck.com/advisories/rengine-authenticated-command-injection-via-scan-engine-configuration · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-58287 · Nota de Segurança