VulnerabilityDeferred

CVE-2024-9166

The device enables an unauthorized attacker to execute system commands with elevated privileges.

CRITICAL 9.3EPSS 1.58%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.58% probability · 74th percentile
CISA KEV: Not listed
Weakness: CWE-78
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-03

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.