PT-2024-30199 · Beijing Digital China Cloud Technology Co. · Dcme-320

Published 2024-08-28 · Updated 2024-08-31 · CVE-2024-42905

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Beijing Digital China Cloud Technology Co., Ltd. DCME-320 version 7.4.12.60

Description A command execution vulnerability is present in the DCME-320 device, which can be exploited to obtain device administrator privileges via the getVar function in the code/function/system/tool/ping.php file. This issue allows for the execution of commands, potentially leading to unauthorized access and control of the device.

Recommendations For version 7.4.12.60, consider disabling the getVar function in the ping.php file as a temporary workaround until a patch is available. Restrict access to the code/function/system/tool/ping.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-42905

Affected Products

Dcme-320

References · 8

• 🔥 https://github.com/ZackSecurity/VulnerReport/blob/cve/DCN/1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42905 · Security Note
• https://t.me/cvedetector/4346 · Telegram Post
• https://t.me/cvenotify/92558 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1828895037033230720 · Twitter Post
• https://immense-mirror-b42.notion.site/Beijing-Digital-China-Yunke-Information-Technology-Co-Ltd-DCN-firewall-has-a-command-execution-vuln-31bdd1228f6d47c09e854af5f0e7059f · Note
• https://twitter.com/cracbot/status/1830123572141912175 · Twitter Post
• https://twitter.com/CVEnew/status/1828850175449719213 · Twitter Post