PT-2024-32983 · Sunniwell · Sunniwell Ht3300

Giles-One · Published 2024-11-08 · Updated 2024-11-18 · CVE-2024-48073

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions sunniwell HT3300 versions before 1.0.0.B022.2

Description The issue concerns insecure permissions in the sunniwell HT3300 device, specifically with the /usr/local/bin/update program, which is used for software updates and has the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, allowing an attacker to pass commands via command line arguments to gain elevated root privileges.

Recommendations For sunniwell HT3300 versions before 1.0.0.B022.2, update to version 1.0.0.B022.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /usr/local/bin/update program to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-48073

Affected Products

Sunniwell Ht3300

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-48073 · Security Note
• https://t.me/cvedetector/10226 · Telegram Post
• https://twitter.com/CVEnew/status/1855002071235268815 · Twitter Post
• https://github.com/Giles-one/sunniwellHT3300PrivilegeEscalation · Note
• https://gist.github.com/Giles-one/56f677b96aab5a67fbe31dd41fd1303d · Note
• https://twitter.com/VulmonFeeds/status/1855049340395344046 · Twitter Post