PT-2024-28412 · Unknown · Thunderobot Control Center

Published 2024-07-01 · Updated 2024-10-25 · CVE-2024-39251

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ThundeRobot Control Center version 2.0.0.10

Description The issue in the component ControlCenter.sys/ControlCenter64.sys allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests.

Recommendations For ThundeRobot Control Center version 2.0.0.10, consider restricting access to the ControlCenter.sys and ControlCenter64.sys components to minimize the risk of exploitation. As a temporary workaround, avoid using the vulnerable component until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-782

Related Identifiers

CVE-2024-39251

Affected Products

Thunderobot Control Center

References · 5

• 🔥 https://github.com/Souhardya/Exploit-PoCs/tree/main/ThundeRobot_Control_center · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39251 · Security Note
• https://t.me/cvenotify/85848 · Telegram Post
• https://t.me/cvenotify/84950 · Telegram Post
• https://t.me/cvenotify/99543 · Telegram Post