CVE-2024-13129

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-13129", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-01-03T14:52:21.862Z", "datePublished": "2025-01-03T21:31:06.704Z", "dateUpdated": "2025-08-28T14:41:10.652Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-01-03T21:31:06.704Z"}, "title": "Roxy-WI roxy.py action_service os command injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "OS Command Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "Command Injection"}]}], "affected": [{"vendor": "n/a", "product": "Roxy-WI", "versions": [{"version": "8.1.0", "status": "affected"}, {"version": "8.1.1", "status": "affected"}, {"version": "8.1.2", "status": "affected"}, {"version": "8.1.3", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. It is recommended to upgrade the affected component."}, {"lang": "de", "value": "In Roxy-WI bis 8.1.3 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es die Funktion action_service der Datei app/modules/roxywi/roxy.py. Mit der Manipulation des Arguments action/service mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 8.1.4 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 32313928eb9ce906887b8a30bf7b9a3d5c0de1be bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseSeverity": "HIGH"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "HIGH"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseSeverity": "HIGH"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "timeline": [{"time": "2025-01-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-01-03T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-01-03T15:58:41.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "slash0x99 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.290149", "name": "VDB-290149 | Roxy-WI roxy.py action_service os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.290149", "name": "VDB-290149 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.468530", "name": "Submit #468530 | Roxy-wi https://github.com/roxy-wi/roxy-wi <8.1.3 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/roxy-wi/roxy-wi/pull/410", "tags": ["issue-tracking"]}, {"url": "https://github.com/roxy-wi/roxy-wi/pull/410#issuecomment-2561289700", "tags": ["issue-tracking"]}, {"url": "https://github.com/0xs1ash/Exploits/tree/main/CVE-EXPLOIT", "tags": ["exploit"]}, {"url": "https://github.com/roxy-wi/roxy-wi/pull/410/commits/32313928eb9ce906887b8a30bf7b9a3d5c0de1be", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/roxy-wi/roxy-wi/releases/tag/v8.1.4", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-01-03T22:04:46.555642Z", "id": "CVE-2024-13129", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T14:41:10.652Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-13129", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-01-03T22:04:46.555642Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-01-03T22:06:08.771Z"}}], "cna": {"title": "Roxy-WI roxy.py action_service os command injection", "credits": [{"lang": "en", "type": "reporter", "value": "slash0x99 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 9, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "affected": [{"vendor": "n/a", "product": "Roxy-WI", "versions": [{"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.3"}]}], "timeline": [{"lang": "en", "time": "2025-01-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-01-03T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-01-03T15:58:41.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.290149", "name": "VDB-290149 | Roxy-WI roxy.py action_service os command injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.290149", "name": "VDB-290149 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.468530", "name": "Submit #468530 | Roxy-wi https://github.com/roxy-wi/roxy-wi <8.1.3 OS Command Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/roxy-wi/roxy-wi/pull/410", "tags": ["issue-tracking"]}, {"url": "https://github.com/roxy-wi/roxy-wi/pull/410#issuecomment-2561289700", "tags": ["issue-tracking"]}, {"url": "https://github.com/0xs1ash/Exploits/tree/main/CVE-EXPLOIT", "tags": ["exploit"]}, {"url": "https://github.com/roxy-wi/roxy-wi/pull/410/commits/32313928eb9ce906887b8a30bf7b9a3d5c0de1be", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/roxy-wi/roxy-wi/releases/tag/v8.1.4", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. It is recommended to upgrade the affected component."}, {"lang": "de", "value": "In Roxy-WI bis 8.1.3 wurde eine kritische Schwachstelle ausgemacht. Hierbei betrifft es die Funktion action_service der Datei app/modules/roxywi/roxy.py. Mit der Manipulation des Arguments action/service mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung. Ein Aktualisieren auf die Version 8.1.4 vermag dieses Problem zu l\u00f6sen. Der Patch wird als 32313928eb9ce906887b8a30bf7b9a3d5c0de1be bezeichnet. Als bestm\u00f6gliche Massnahme wird das Einspielen eines Upgrades empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "OS Command Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "Command Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-01-03T21:31:06.704Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13129", "state": "PUBLISHED", "dateUpdated": "2025-08-28T14:41:10.652Z", "dateReserved": "2025-01-03T14:52:21.862Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-01-03T21:31:06.704Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Roxy-WI", "vendor": "n/a", "versions": [{"status": "affected", "version": "8.1.0"}, {"status": "affected", "version": "8.1.1"}, {"status": "affected", "version": "8.1.2"}, {"status": "affected", "version": "8.1.3"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.1.4 is able to address this issue. The identifier of the patch is 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. It is recommended to upgrade the affected component."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad en Roxy-WI hasta la versi\u00f3n 8.1.3. Se ha declarado como cr\u00edtica. La funci\u00f3n action_service del archivo app/modules/roxywi/roxy.py est\u00e1 afectada por esta vulnerabilidad. La manipulaci\u00f3n del argumento action/service provoca la inyecci\u00f3n de comandos del sistema operativo. El ataque se puede ejecutar de forma remota. El exploit se ha hecho p\u00fablico y puede utilizarse. La actualizaci\u00f3n a la versi\u00f3n 8.1.4 puede solucionar este problema. El identificador del parche es 32313928eb9ce906887b8a30bf7b9a3d5c0de1be. Se recomienda actualizar el componente afectado."}], "id": "CVE-2024-13129", "lastModified": "2026-06-17T07:01:16.300", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 9.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-13129", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-01-03T22:04:46.555642Z", "version": "2.0.3"}}]}, "published": "2025-01-03T22:15:06.677", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/0xs1ash/Exploits/tree/main/CVE-EXPLOIT"}, {"source": "cna@vuldb.com", "url": "https://github.com/roxy-wi/roxy-wi/pull/410"}, {"source": "cna@vuldb.com", "url": "https://github.com/roxy-wi/roxy-wi/pull/410#issuecomment-2561289700"}, {"source": "cna@vuldb.com", "url": "https://github.com/roxy-wi/roxy-wi/pull/410/commits/32313928eb9ce906887b8a30bf7b9a3d5c0de1be"}, {"source": "cna@vuldb.com", "url": "https://github.com/roxy-wi/roxy-wi/releases/tag/v8.1.4"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.290149"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.290149"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.468530"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}, {"lang": "en", "value": "CWE-78"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:42:34.159588+00:00", "updated": "2025-07-12T15:42:34.159650+00:00", "vendors": ["roxy-wi", "roxy-wi$PRODUCT$roxy-wi"]}