PT-2024-10171 · Unknown · License Center

Anh Nguyen Le Quoc + 7 · Published 2024-10-09 · Updated 2024-12-09 · CVE-2024-48863

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions License Center versions prior to 1.9.43

Description A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. This issue is related to the failure to neutralize special elements used in operating system commands.

Recommendations For versions prior to 1.9.43, update to License Center 1.9.43 or later to resolve the issue. As a temporary workaround, consider restricting access to the License Center to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-00498

CVE-2024-48863

Affected Products

License Center

References · 9

• https://osv.dev/vulnerability/CVE-2024-48863 · Vendor Advisory
• https://qnap.com/en/security-advisory/qsa-24-50 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00498 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-48863 · Security Note
• https://t.me/cvedetector/12256 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1865942167946211626 · Twitter Post
• https://twitter.com/eyalestrin/status/1866028265443582375 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1865172797950935080 · Twitter Post
• https://twitter.com/CVEnew/status/1865075392798765080 · Twitter Post