PT-2024-39573 · Intelbras · Intelbras Incontrol

Stux · Published 2024-09-29 · Updated 2025-10-16 · CVE-2024-9324

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intelbras InControl versions up to 2.21.57

Description A critical issue affects some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the fields argument leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Intelbras InControl versions up to 2.21.57, upgrade to version 2.21.58 to address this issue. As a temporary workaround, consider restricting access to the /v1/operador/ endpoint of the Relatório de Operadores Page until the patch is applied.

Exploit

Fix

LPE

Improper Neutralization

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-707

CWE-74

CWE-94

Related Identifiers

CVE-2024-9324

Affected Products

Intelbras Incontrol

References · 14

• 🔥 https://vuldb.com/?submit.375614 · Exploit
• https://osv.dev/vulnerability/CVE-2024-9324 · Vendor Advisory
• https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-9324 · Security Note
• https://t.me/cvenotify/96503 · Telegram Post
• https://vuldb.com/?ctiid.278828 · Note
• https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdf · Note
• https://t.me/aptreports/22861 · Telegram Post
• https://twitter.com/rst_cloud/status/1978783720153723330 · Twitter Post
• https://t.me/cvedetector/6621 · Telegram Post
• https://vuldb.com/?id.278828 · Note
• https://twitter.com/stux_rs/status/1854854066976764196 · Twitter Post
• https://t.me/cvenotify/97287 · Telegram Post
• https://youtu.be/UdZVktPUy8A · Note