CVE-2024-48904

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-48904", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "state": "PUBLISHED", "assignerShortName": "trendmicro", "dateReserved": "2024-10-09T19:03:26.733Z", "datePublished": "2024-10-22T18:28:59.027Z", "dateUpdated": "2024-10-22T19:00:48.004Z"}, "containers": {"cna": {"affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Cloud Edge", "versions": [{"version": "5.6SP2, 7.0", "status": "affected", "versionType": "semver", "lessThan": "5.6.3228, 7.0.1081"}]}], "descriptions": [{"lang": "en", "value": "An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.\r\n\r\nPlease note: authentication is not required in order to exploit this vulnerability."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2024-10-22T18:28:59.027Z"}, "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0017998"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1418/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "affected": [{"vendor": "trendmicro", "product": "cloud_edge", "cpes": ["cpe:2.3:a:trendmicro:cloud_edge:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "5.6sp2", "status": "affected", "lessThan": "5.6.3228", "versionType": "custom"}, {"version": "7.0", "status": "affected", "lessThan": "7.0.1081", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-22T18:54:54.135767Z", "id": "CVE-2024-48904", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T19:00:48.004Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-48904", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-22T18:54:54.135767Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:trendmicro:cloud_edge:*:*:*:*:*:*:*:*"], "vendor": "trendmicro", "product": "cloud_edge", "versions": [{"status": "affected", "version": "5.6sp2", "lessThan": "5.6.3228", "versionType": "custom"}, {"status": "affected", "version": "7.0", "lessThan": "7.0.1081", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T18:57:14.688Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Trend Micro, Inc.", "product": "Trend Micro Cloud Edge", "versions": [{"status": "affected", "version": "5.6SP2, 7.0", "lessThan": "5.6.3228, 7.0.1081", "versionType": "semver"}]}], "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0017998"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1418/"}], "descriptions": [{"lang": "en", "value": "An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.\r\n\r\nPlease note: authentication is not required in order to exploit this vulnerability."}], "providerMetadata": {"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro", "dateUpdated": "2024-10-22T18:28:59.027Z"}}}, "cveMetadata": {"cveId": "CVE-2024-48904", "state": "PUBLISHED", "dateUpdated": "2024-10-22T19:00:48.004Z", "dateReserved": "2024-10-09T19:03:26.733Z", "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "datePublished": "2024-10-22T18:28:59.027Z", "assignerShortName": "trendmicro"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Trend Micro Cloud Edge", "vendor": "Trend Micro, Inc.", "versions": [{"lessThan": "5.6.3228, 7.0.1081", "status": "affected", "version": "5.6SP2, 7.0", "versionType": "semver"}]}], "source": "security@trendmicro.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:trendmicro:cloud_edge:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "cloud_edge", "vendor": "trendmicro", "versions": [{"lessThan": "5.6.3228", "status": "affected", "version": "5.6sp2", "versionType": "custom"}, {"lessThan": "7.0.1081", "status": "affected", "version": "7.0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:cloud_edge:*:*:*:*:*:*:*:*", "matchCriteriaId": "24B9410C-CEFA-4CD1-9849-50DADC252AB3", "versionEndExcluding": "5.6.3228", "versionStartIncluding": "5.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:cloud_edge:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0821086-0C1D-4100-9D50-BFDC799D5541", "versionEndExcluding": "7.0.1081", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.\r\n\r\nPlease note: authentication is not required in order to exploit this vulnerability."}, {"lang": "es", "value": " Una vulnerabilidad de inyecci\u00f3n de comandos en Trend Micro Cloud Edge podr\u00eda permitir que un atacante remoto ejecute c\u00f3digo arbitrario en los dispositivos afectados. Tenga en cuenta que no se requiere autenticaci\u00f3n para explotar esta vulnerabilidad."}], "id": "CVE-2024-48904", "lastModified": "2026-06-17T07:59:00.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@trendmicro.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-48904", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-10-22T18:54:54.135767Z", "version": "2.0.3"}}]}, "published": "2024-10-22T19:15:06.763", "references": [{"source": "security@trendmicro.com", "tags": ["Vendor Advisory"], "url": "https://success.trendmicro.com/en-US/solution/KA-0017998"}, {"source": "security@trendmicro.com", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1418/"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}