PT-2024-27520 · Unknown · Cym1102 Nginxwebui

Qqwp220 · Published 2024-04-13 · Updated 2025-08-21 · CVE-2024-3740

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cym1102 nginxWebUI versions up to 3.9.9

Description A critical issue has been found in the function exec of the file /adminPage/conf/reload. The manipulation of the argument nginxExe leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 3.9.9, as a temporary workaround, consider disabling the exec function of the file /adminPage/conf/reload until a patch is available. Restrict access to the /adminPage/conf/reload file to minimize the risk of exploitation. Avoid using the argument nginxExe in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2024-3740

Affected Products

Cym1102 Nginxwebui

References · 11

• 🔥 https://github.com/cym1102/nginxWebUI/files/14818455/nginxwebui.rce.3.9.9.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2024-3740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3740 · Security Note
• https://github.com/cym1102/nginxWebUI/issues/138 · Note
• https://twitter.com/VulmonFeeds/status/1779280430325232056 · Twitter Post
• https://t.me/cveNotify/132970 · Telegram Post
• https://twitter.com/CVEnew/status/1779247629257568477 · Twitter Post
• https://vuldb.com/?id.260579 · Note
• https://t.me/cvenotify/76679 · Telegram Post
• https://vuldb.com/?submit.311216 · Note
• https://vuldb.com/?ctiid.260579 · Note