PT-2025-2805 · Flxeon · Flxeon

Published 2024-10-08 · Updated 2025-02-21 · CVE-2024-48841

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions: FLXEON versions 9.3.4 and older

Description: Network access can be used to execute arbitrary code with elevated privileges. This issue is related to incorrect handling of file names for PHP functions include or require, which may allow a remote attacker to gain elevated privileges and execute arbitrary code.

Recommendations: For FLXEON versions 9.3.4 and older, at the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-98

CWE-77

Related Identifiers

BDU:2025-01292

CVE-2024-48841

Affected Products

Flxeon

References · 21

• 🔥 https://exploit-db.com/exploits/52186 · Exploit
• 🔥 https://exploit-db.com/exploits/52188 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48841 · Security Note
• https://bdu.fstec.ru/vul/2025-01292 · Security Note
• https://t.me/cvenotify/111364 · Telegram Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch · Note
• https://twitter.com/syedaquib77/status/1892840350508863673 · Twitter Post
• https://t.me/cvedetector/16506 · Telegram Post
• https://twitter.com/CVEnew/status/1883962251066896751 · Twitter Post
• https://t.me/pentestingnews/55855 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1884785213852840446 · Twitter Post
• https://twitter.com/TMJIntel/status/1885076776449093696 · Twitter Post
• https://twitter.com/CVETracker/status/1884330793759015367 · Twitter Post
• https://twitter.com/CveFindCom/status/1883961502266228971 · Twitter Post
• https://search.abb.com/library/Download.aspx?DocumentID=9AKK108470A5684&LanguageCode=en&DocumentPartId=PDF&Action=Launch · Note