PT-2025-23119 · M2Soft · M2Soft Crownix Report & Ers

Published 2025-05-28 · Updated 2025-05-28 · CVE-2024-57338

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions M2Soft CROWNIX Report & ERS versions 5.x through 5.5.14.1070 M2Soft CROWNIX Report & ERS versions 7.x through 7.4.3.960 M2Soft CROWNIX Report & ERS versions 8.x through 8.2.0.345

Description An arbitrary file upload issue allows attackers to execute arbitrary code via supplying a crafted file.

Recommendations For versions 5.x through 5.5.14.1070, restrict access to file upload functionality to minimize the risk of exploitation. For versions 7.x through 7.4.3.960, consider disabling file upload features until a patch is available. For versions 8.x through 8.2.0.345, avoid using the file upload module to prevent potential code execution. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-57338

Affected Products

M2Soft Crownix Report & Ers

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-57338 · Security Note
• https://m2soft.co.kr/sub/board/news.asp?mode=view&idx=2411 · Note
• https://twitter.com/CVEnew/status/1927784575570231324 · Twitter Post