PT-2024-31833 · Motorola · Motorola Cx2

Published 2024-10-08 · Updated 2024-10-13 · CVE-2024-45880

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Motorola CX2L router versions 1.0.2 and below

Description A command injection issue exists, allowing malicious users to inject and execute arbitrary commands. This is due to the system directly invoking the system function to execute commands for setting parameters, such as the MAC address, without proper input filtering. The vulnerability is present in the SetStationSettings function.

Recommendations For versions 1.0.2 and below, consider disabling the SetStationSettings function until a patch is available to prevent command injection attacks. Restrict access to the system function to minimize the risk of exploitation. Avoid using the function to set parameters such as the MAC address until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-45880

Affected Products

Motorola Cx2

References · 6

• https://osv.dev/vulnerability/CVE-2024-45880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45880 · Security Note
• https://github.com/N1nEmAn/wp/blob/main/m0tOrol%40-Cx2l.pdf · Note
• https://t.me/cvedetector/7363 · Telegram Post
• https://twitter.com/cracbot/status/1845343825184817613 · Twitter Post
• https://twitter.com/CVEnew/status/1843672050550112577 · Twitter Post