PT-2024-38453 · Edimax · Edimax Ic-6220Dc+1

Jylsec · Published 2024-08-08 · Updated 2024-08-15 · CVE-2024-7616

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Edimax IC-6220DC and IC-5150W versions up to 3.06

Description A critical issue affects the cgiFormString function of the ipcam cgi file. The manipulation of the host argument leads to command injection. The vendor was contacted about this disclosure but did not respond.

Recommendations For Edimax IC-6220DC and IC-5150W versions up to 3.06, upgrade to a version above 3.06 as soon as possible. As a temporary workaround, consider restricting access to the cgiFormString function until a patch is available. Avoid using the host parameter in the affected ipcam cgi file until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-7616

Affected Products

Edimax Ic-5150W

Edimax Ic-6220Dc

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-7616 · Security Note
• https://osv.dev/vulnerability/CVE-2024-7616 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1823024203286589526 · Twitter Post
• https://twitter.com/oktsec/status/1824253302160130205 · Twitter Post
• https://yjz233.notion.site/edimax-IC-6220DC-has-command-injection-vulnerability-in-ipcam_cgi-2029d67721f2473b8cfce5e286a70307?pvs=4 · Note
• https://vuldb.com/?submit.383845 · Note
• https://twitter.com/SecAideInfo/status/1823664043736858929 · Twitter Post
• https://vuldb.com/?id.273986 · Note
• https://vuldb.com/?ctiid.273986 · Note
• https://t.me/cvenotify/90368 · Telegram Post
• https://yjz233.notion.site/edimax-IC-5150W-has-command-injection-vulnerability-in-ipcam_cgi-cc72c7b7e2f24ba6a6609b6fcf78df34 · Note