PT-2024-35808 · Ae1021Pe+1 · Ae1021Pe+1

Chuya Hayakawa + 1 · Published 2024-12-18 · Updated 2024-12-23 · CVE-2024-53688

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AE1021 firmware versions 2.0.10 and earlier AE1021PE firmware versions 2.0.10 and earlier

Description An issue exists due to the improper neutralization of special elements used in an OS command, which may allow a logged-in user to execute an arbitrary OS command using a crafted HTTP request. This issue is related to 'OS Command Injection'.

Recommendations For AE1021 firmware versions 2.0.10 and earlier, consider disabling the ability to execute OS commands until a patch is available. For AE1021PE firmware versions 2.0.10 and earlier, restrict access to the vulnerable module to minimize the risk of exploitation. As a temporary workaround, avoid using crafted HTTP requests that may trigger the OS command injection issue until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-53688

Affected Products

Ae1021

Ae1021Pe

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-53688 · Security Note
• https://t.me/cvedetector/13169 · Telegram Post
• https://t.me/cvenotify/104669 · Telegram Post
• https://jvn.jp/en/vu/JVNVU91084137 · Note
• https://fxc.jp/news/20241213 · Note
• https://twitter.com/cracbot/status/1871073318566314118 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1869296644736385261 · Twitter Post
• https://twitter.com/CVEnew/status/1869272943101972551 · Twitter Post