Lucene search

INCIBEVULNRICHMENT:CVE-2024-5785

HistoryJun 10, 2024 - 12:13 p.m.

CVE-2024-5785 Command injection vulnerability in Comtrend router

2024-06-1012:13:05

CWE-78

INCIBE

github.com

vulnerability

comtrend router

command injection

authenticated user

post request

url

grg-4280us

cve-2024-5785

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.8%

JSON

Command injection vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”.

CNA Affected

[
  {
    "vendor": "Comtrend",
    "product": "Comtrend WLD71-T1_v2.0.201820",
    "versions": [
      {
        "status": "affected",
        "version": "GRG-4280us",
        "versionType": "hardware"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-comtrend-router

8 High

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.8%

JSON

Related for VULNRICHMENT:CVE-2024-5785