PT-2024-33112 · Tianyu · Tianyu Cpe Router

Published 2024-10-24 · Updated 2024-10-25 · CVE-2024-48441

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tianyu CPE Router version CommonCPExCPETS v3.2.468.11.04 P4

Description A command injection issue was discovered in the Tianyu CPE Router, specifically via the component at command.asp.

Recommendations For version CommonCPExCPETS v3.2.468.11.04 P4, consider restricting access to the at command.asp component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-48441

Affected Products

Tianyu Cpe Router

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-48441 · Security Note
• https://t.me/cvedetector/8825 · Telegram Post
• https://medium.com/%40sengkyaut/unauthenticated-factory-mode-reset-and-at-command-injection-in-jboneos-or-jbonecloud-firmware-1dec156b7ddd · Note