CVE-2024-9977

MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection

View on CVE.org
Published Oct 15, 2024 CVSS 4.0 · 5.1 Medium EPSS 22.9% KEV · Not listed
Description
A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi-bin/settings-firewall.cgi of the component Firewall Settings Page. The manipulation of the argument SrcInterface leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. We tried to contact the vendor early about the disclosure but the official mail address was not working properly.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-50258 A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi-bin/settings-firewall.cgi of the component Firewall Settings Page. The manipulation of the argument SrcInterface leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00841}

 epss

{'score': 0.0096}
Type Values Removed Values Added
First Time appeared Mitrastar
Mitrastar gpt-2541gnac
CPEs cpe:2.3:h:mitrastar:gpt-2541gnac:-:*:*:*:*:*:*:*
Vendors & Products Mitrastar
Mitrastar gpt-2541gnac
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. Affected is an unknown function of the file /cgi-bin/settings-firewall.cgi of the component Firewall Settings Page. The manipulation of the argument SrcInterface leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. We tried to contact the vendor early about the disclosure but the official mail address was not working properly.
Title MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection
Weaknesses CWE-78
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 15, 2024, 1:27 PM
Reserved
Oct 15, 2024, 5:58 AM

View source JSON

Updated
Oct 15, 2024, 1:26 PM

JSON

Status
Deferred
Published
Oct 15, 2024, 1:15 PM
Modified
Jun 17, 2026, 8:25 AM

View source JSON

No data.

No data.