CVE-2024-41153

Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the write privilege intends.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:hitachienergy:tro610_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hitachienergy:tro610:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:hitachienergy:tro620_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hitachienergy:tro620:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:hitachienergy:tro670_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:hitachienergy:tro670:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-29 13:15

Updated : 2024-10-31 14:37

NVD link : CVE-2024-41153

Mitre link : CVE-2024-41153

CVE.ORG link : CVE-2024-41153

JSON object : View

Products Affected

hitachienergy

tro610
tro610_firmware
tro670
tro670_firmware
tro620_firmware
tro620

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-41153", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-10-29T13:15:04.600", "references": [{"url": "https://publisher.hitachienergy.com/preview?DocumentID=8DBD000147&LanguageCode=en&DocumentPartId=&Action=launch", "tags": ["Vendor Advisory"], "source": "cybersecurity@hitachienergy.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cybersecurity@hitachienergy.com", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "Command injection vulnerability in the Edge Computing UI for the\nTRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the\nweb UI can execute commands on the device with root privileges,\nfar more extensive than what the write privilege intends."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos en la interfaz de usuario de Edge Computing para las radios de la serie TRO600 que permite la ejecuci\u00f3n de comandos arbitrarios del sistema. Si se explota, un atacante con acceso de escritura a la interfaz de usuario web puede ejecutar comandos en el dispositivo con privilegios de root, mucho m\u00e1s amplios que los que pretende el privilegio de escritura."}], "lastModified": "2024-10-31T14:37:48.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hitachienergy:tro610_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5C2D2E0-5383-44E5-B8C6-C743503A8E51", "versionEndExcluding": "9.2.0.5", "versionStartIncluding": "9.1.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hitachienergy:tro610:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B3A46C6E-9314-40EB-A8BE-0D3A26B5FE4C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hitachienergy:tro620_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BE01813-8087-4E9B-8B2B-FF813C0E9506", "versionEndExcluding": "9.2.0.5", "versionStartIncluding": "9.1.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hitachienergy:tro620:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DC979E74-6316-4BED-87A6-4DC9B9747E0F"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hitachienergy:tro670_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6A94F87-2875-46C9-8BD3-BE3EA9F71648", "versionEndExcluding": "9.2.0.5", "versionStartIncluding": "9.1.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hitachienergy:tro670:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E84F6910-1D58-4AE7-94EF-797C9BD52690"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cybersecurity@hitachienergy.com"}