CVE-2024-7579mediumCWE-78

CVE-2024-7579: medium-severity vulnerability in Alien Technology ALR-F800

Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection

Published

Follow this CVE+ Monitor ALR-F800

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 8.4%
A vulnerability was found in Alien Technology ALR-F800 up to 19.10.24.00. It has been declared as critical. Affected by this vulnerability is the function popen of the file /var/www/cgi-bin/upgrade.cgi of the component File Name Handler. The manipulation of the argument uploadedFile leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
Alien Technology · ALR-F800
Related CVEs — Alien Technology ALR-F800

In the same product, most dangerous first.

CVE-2024-7580MEDIUMAlien Technology ALR-F800 system.html os command injectionEPSS 8.9%CVE-2024-7578MEDIUMAlien Technology ALR-F800 cmd.php improper authorizationEPSS 0.8%