PT-2024-24240 · Italtel · Italtel Embrace

Fabio Romano + 3 · Published 2024-05-23 · Updated 2024-07-03 · CVE-2024-31843

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Italtel Embrace version 1.6.4

Description The issue is related to improper input validation in the Web application, allowing authenticated users to execute commands on the Operating System.

Recommendations For Italtel Embrace version 1.6.4, update the software to a version that properly checks parameters sent as input before they are processed on the server side. As a temporary workaround, consider restricting access to the Web application to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-31843

Affected Products

Italtel Embrace

References · 3

• 🔥 https://gruppotim.it/it/footer/red-team.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-31843 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31843 · Vendor Advisory