PT-2024-19054 · Unknown · Mc Lr Router

Matt Wiseman · Published 2024-11-21 · Updated 2024-12-18 · CVE-2024-21786

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MC LR Router version 2.10.5

Description An OS command injection vulnerability exists in the web interface configuration upload functionality. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.

Recommendations For version 2.10.5, patch immediately to prevent potential system compromise. As a temporary workaround, consider restricting access to the web interface configuration upload functionality until a patch is available. Monitor for exploit attempts to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-21786

Affected Products

Mc Lr Router

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2024-1954 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-21786 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21786 · Vendor Advisory
• https://twitter.com/CVEnew/status/1859610619936374901 · Twitter Post
• https://t.me/cvenotify/104708 · Telegram Post
• https://twitter.com/oktsec/status/1859637471165743272 · Twitter Post