Lucene search

MitreCVE-2024-24091

HistoryFeb 08, 2024 - 6:15 a.m.

CVE-2024-24091

2024-02-0806:15:51

CWE-78

CWE-94

mitre

web.nvd.nist.gov

yealink meeting server

cve-2024-24091

os command injection

vulnerability

file upload

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

30.1%

JSON

Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.

Affected configurations

Nvd

Node

yealinkyealink_meeting_serverRange<26.0.0.66

VendorProductVersionCPE
yealinkyealink_meeting_server*cpe:2.3:a:yealink:yealink_meeting_server:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
yealink	yealink_meeting_server	*	cpe:2.3:a:yealink:yealink_meeting_server::::::::

References

www.yealink.com/en/trust-center/security-advisories/2f2b990211c440cf

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

30.1%

JSON

Related for CVE-2024-24091