The vulnerability of the ssvpn_config_mod function in the /vpn/list_service_manage.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 integrated routing software allows a malicious actor to execute arbitrary commands.

🗓️ 07 Aug 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Raisecom ssvpn_config_mod flaw enables remote command execution via /vpn/list_service_manage.php and /vpn/list_ip_network.php.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-7468	5 Aug 202406:22	–	circl
CNNVD	Raisecom MSG1200、Raisecom MSG2100E、Raisecom MSG2200和Raisecom MSG2300 操作系统命令注入漏洞	5 Aug 202400:00	–	cnnvd
CVE	CVE-2024-7468	5 Aug 202403:00	–	cve
Cvelist	CVE-2024-7468 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injection	5 Aug 202403:00	–	cvelist
EUVD	EUVD-2024-48389	3 Oct 202520:07	–	euvd
NVD	CVE-2024-7468	5 Aug 202403:16	–	nvd
OSV	CVE-2024-7468	5 Aug 202403:16	–	osv
Positive Technologies	PT-2024-5394 · Raisecom · Raisecom Msg2200 +3	4 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-7468	23 May 202509:51	–	redhatcve
Vulnrichment	CVE-2024-7468 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injection	5 Aug 202403:00	–	vulnrichment

Vulners

Node

raisecom raisecom_msg1200Match3.90

OR

raisecom raisecom_msg2100eMatch3.90

OR

raisecom raisecom_msg2200Match3.90

OR

raisecom raisecom_msg2300Match3.90

Source	Link
github	www.github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/sQrromK7x42JbLgY/Command%20Injection%20Vulnerability%20in%20RAISECOM%20Gateway%20Devices-list_service_manage.php.pdf
vuldb	www.vuldb.com/
web	www.web.nvd.nist.gov/view/vuln/detail

07 Aug 2024 00:00Current

7High risk

Vulners AI Score7

CVSS 39.8

CVSS 210

EPSS0.24873

ssvpn_config_mod raisecom routers remote command execution list_service_manage list_ip_network