PT-2025-2192 · Newtec · Newtec/Idirect Ntc2218+2

James Pavur · Published 2025-01-17 · Updated 2025-01-17 · CVE-2024-13502

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Newtec/iDirect NTC2218, NTC2250, NTC2299 versions 1.0.1.1 through 2.2.6.19

Description The issue affects the commit multicast page in the modem's web administration interface, which improperly parses incoming data from the request before passing it to an eval statement in a bash script. This allows attackers to inject arbitrary shell commands, enabling Local Code Inclusion.

Recommendations For versions 1.0.1.1 through 2.2.6.19, consider disabling the commit multicast page in the web administration interface as a temporary workaround until a patch is available. Restrict access to the bash script that uses the eval statement to minimize the risk of exploitation. Avoid using the eval statement in the bash script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-13502

Affected Products

Newtec/Idirect Ntc2218

Newtec/Idirect Ntc2250

Newtec/Idirect Ntc2299

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-13502 · Security Note
• https://doi.org/10.1145/3643833.3656139 · Note
• https://t.me/cvedetector/15704 · Telegram Post
• https://twitter.com/CVEnew/status/1880384736599609345 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1880268605226381612 · Twitter Post
• https://twitter.com/CveFindCom/status/1880262263329746956 · Twitter Post
• https://youtube.com/watch?v=-pxmly8xeas · Note