PT-2025-20736 · Unknown · Thingsboard

Published 2025-05-12 · Updated 2025-05-12 · CVE-2024-55466

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ThingsBoard versions 3.8.1 and below

Description An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard allows attackers to execute arbitrary code via uploading a crafted file.

Recommendations For versions 3.8.1 and below, update to a version above 3.8.1 to resolve the issue. As a temporary workaround, consider disabling the Image Gallery feature until a patch is available. Restrict access to the Image Gallery to minimize the risk of exploitation.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-55466

Affected Products

Thingsboard

References · 8

• 🔥 https://github.com/cybsecsid/ThingsBoard-IoT-Platform-CVE-2024-55466 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-55466 · Security Note
• https://osv.dev/vulnerability/CVE-2024-55466 · Vendor Advisory
• https://github.com/thingsboard/thingsboard/releases/tag/v3.8.1 · Note
• https://twitter.com/VulmonFeeds/status/1922024490009039192 · Twitter Post
• https://t.me/cvetracker/23649 · Telegram Post
• https://t.me/cvedetector/25111 · Telegram Post
• https://twitter.com/CVEnew/status/1922007229957357985 · Twitter Post