CVE-2024-5196

🗓️ 22 May 2024 12:00:05Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 54 Views🌐 WEB

Critical vulnerability in Arris VAP2500 08.50 allows remote command injection via /tools_command.php

Reporter	Title	Published	Views	Family All 6
CNNVD	Arris VAP2500 安全漏洞	22 May 202400:00	–	cnnvd
Cvelist	CVE-2024-5196 Arris VAP2500 tools_command.php command injection	22 May 202412:00	–	cvelist
EUVD	EUVD-2024-46439	3 Oct 202520:07	–	euvd
NVD	CVE-2024-5196	22 May 202412:15	–	nvd
RedhatCVE	CVE-2024-5196	23 May 202509:03	–	redhatcve
Vulnrichment	CVE-2024-5196 Arris VAP2500 tools_command.php command injection	22 May 202412:00	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

arris vap2500_firmwareMatch08.50

AND

arris vap2500Match-

[
  {
    "vendor": "Arris",
    "product": "VAP2500",
    "versions": [
      {
        "version": "08.50",
        "status": "affected"
      }
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/a%2B%26%5BE4%3Flp5%3Fk9_%3D%5D/ARRIS_VAP2500-RCE-tools_command.php.pdf
vuldb	www.vuldb.com/

Parameter	Position	Path	Description	CWE
cmb_header	query param	/tools_command.php	Command injection via parameters cmb_header and txt_command in /tools_command.php	CWE-77
txt_command	query param	/tools_command.php	Command injection via parameters cmb_header and txt_command in /tools_command.php	CWE-77

14 Oct 2025 19:36Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.14.7 - 7.2

CVSS 45.1

CVSS 25.8

CVSS 34.7

EPSS0.00256

SSVC

CWE-77