PT-2025-23118 · M2Soft · M2Soft Crownix Report & Ers

Published 2025-05-28 · Updated 2025-05-28 · CVE-2024-57337

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions M2Soft CROWNIX Report & ERS versions 5.x through 5.5.14.1070 M2Soft CROWNIX Report & ERS versions 7.x through 7.4.3.960 M2Soft CROWNIX Report & ERS versions 8.x through 8.2.0.345

Description An arbitrary file upload issue in the opcode 500 functionality allows attackers to execute arbitrary code by supplying a crafted file.

Recommendations For versions 5.x through 5.5.14.1070, consider disabling the opcode 500 functionality until a patch is available. For versions 7.x through 7.4.3.960, restrict access to the file upload feature to minimize the risk of exploitation. For versions 8.x through 8.2.0.345, avoid using the crafted file supply method in the opcode 500 functionality until the issue is resolved.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-57337

Affected Products

M2Soft Crownix Report & Ers

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-57337 · Security Note
• https://m2soft.co.kr/sub/board/news.asp?mode=view&idx=2411 · Note
• https://twitter.com/CVEnew/status/1927784574471311756 · Twitter Post