PT-2024-31794 · Faraday · Faraday Gm828X+1

Netsecfish · Published 2024-05-07 · Updated 2024-06-04 · CVE-2024-4582

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Faraday GM8181 and GM828x up to 20240429

Description: A critical vulnerability has been found in the NTP Service component. The manipulation of the ntp srv argument leads to os command injection, allowing for remote attacks. The exploit has been disclosed publicly and may be used.

Recommendations: For Faraday GM8181 and GM828x up to 20240429, it is recommended to upgrade the affected component to a newer version. As a temporary workaround, consider restricting access to the NTP Service component to minimize the risk of exploitation. Avoid using the ntp srv argument in the affected component until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-4582

Affected Products

Faraday Gm8181

Faraday Gm828X

References · 8

• 🔥 https://file.notion.so/f/f/3f67e7ef-2ba8-446a-9721-f87d0baa1695/fa61d774-823d-4516-8ff3-73c310ff7801/command_injection_submit.py?id=6d18aced-daaa-4e52-a0e8-9d1c5e00acee&table=block&spaceId=3f67e7ef-2ba8-446a-9721-f87d0baa1695&expirationTimestamp=171514800 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-4582 · Security Note
• https://vuldb.com/?id.263304 · Note
• https://vuldb.com/?ctiid.263304 · Note
• https://t.me/cvenotify/79374 · Telegram Post
• https://netsecfish.notion.site/Command-Injection-in-Faraday-Technology-GM828x-GM8181-DVR-1bc02d17ee5540a08273da2850e809c4?pvs=4 · Note
• https://twitter.com/CVEnew/status/1787888361455177960 · Twitter Post
• https://vuldb.com/?submit.324393 · Note