PT-2025-50741 · Rengine · Rengine

Caner Tercan · Published 2025-12-11 · Updated 2026-01-20 · CVE-2024-58287

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions reNgine version 2.2.0

Description The software contains a command injection issue in the nmap cmd parameter within the scan engine configuration. Authenticated attackers can execute arbitrary commands by modifying the nmap cmd parameter with malicious base64-encoded payloads during scan engine configuration. This allows for remote code execution. The vulnerable parameter is nmap cmd.

Recommendations Versions prior to 2.2.0 are not affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-58287

Affected Products

Rengine

References · 8

• 🔥 https://exploit-db.com/exploits/52081 · Exploit
• https://osv.dev/vulnerability/CVE-2024-58287 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58287 · Security Note
• https://github.com/yogeshojha/rengine · Note
• https://t.me/cveNotify/149319 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999332259518693657 · Twitter Post
• https://rengine.wiki · Note
• https://vulncheck.com/advisories/rengine-authenticated-command-injection-via-scan-engine-configuration · Note