Common Weakness Enumeration

CWE-78

Allowed

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Abstraction: Base · Status: Stable

API response cwe.mitre.org

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

8342 vulnerabilities reference this CWE, most recent first.

CVE-2024-43648 (GCVE-0-2024-43648)

Vulnerability from cvelistv5 – Published: 2025-01-09 07:56 – Updated: 2025-03-11 13:07
VLAI
Title
Authenticated command injection via <redacted>.exe <redacted> parameter
Summary
Command injection in the <redacted> parameter of a <redacted>.exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all <redacted> fields. The attacker will also need a (low privilege) account to gain access to the <redacted> binary, or convince a user with such access to execute a payload. Impact: Critical – The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services. CVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).  A compromised charger can be used to "pivot" onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/SA:H). Because this device is an EV charger handing significant amounts of power, we suspect this vulnerability can have a safety impact (S:P). The attack can be automated (AU:Y).
Severity
9.3 (Critical)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/S:P/AU:Y
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-250 - Execution with Unnecessary Privileges
  • OWASP-A03: Injection
Assigner
References
Impacted products
Vendor Product Version
Iocharger Iocharger firmware for AC models Affected: 0 , < 24120701 (custom)
Create a notification for this product.
Date Public
2025-01-09 00:00
Credits
Wilco van Beijnum Harm van den Brink (DIVD) Frank Breedijk (DIVD)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-43648",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-09T14:45:36.579487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-09T14:46:04.780Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Iocharger firmware for AC models",
          "vendor": "Iocharger",
          "versions": [
            {
              "lessThan": "24120701",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wilco van Beijnum"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Harm van den Brink (DIVD)"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Frank Breedijk (DIVD)"
        }
      ],
      "datePublic": "2025-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Command injection in the \u0026lt;redacted\u0026gt; parameter of a \u0026lt;redacted\u0026gt;.exe request leads to remote code execution as the root user.\u003cbr\u003e\u003cbr\u003eThis issue affects Iocharger firmware for AC models before version 24120701.\u003cbr\u003e\u003cbr\u003eLikelihood: Moderate \u2013 This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all \u0026lt;redacted\u0026gt; fields. The attacker will also need a (low privilege) account to gain access to the \u0026lt;redacted\u0026gt; binary, or convince a user with such access to execute a payload.\u003cbr\u003e\u003cbr\u003eImpact: Critical \u2013 The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.\u003cbr\u003e\u003cbr\u003eCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).\u0026nbsp; A compromised charger can be used to \"pivot\" onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/SA:H).\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eBecause this device is an EV charger handing significant amounts of power, we suspect this vulnerability can have a safety impact (\u003c/span\u003eS:P). The attack can be automated (AU:Y).\u003cbr\u003e"
            }
          ],
          "value": "Command injection in the \u003credacted\u003e parameter of a \u003credacted\u003e.exe request leads to remote code execution as the root user.\n\nThis issue affects Iocharger firmware for AC models before version 24120701.\n\nLikelihood: Moderate \u2013 This action is not a common place for command injection vulnerabilities to occur. Thus, an attacker will likely only be able to find this vulnerability by reverse-engineering the firmware or trying it on all \u003credacted\u003e fields. The attacker will also need a (low privilege) account to gain access to the \u003credacted\u003e binary, or convince a user with such access to execute a payload.\n\nImpact: Critical \u2013 The attacker has full control over the charging station as the root user, and can arbitrarily add, modify and delete files and services.\n\nCVSS clarification. The attack can be executed over any network connection the station is listening to and serves the web interface (AV:N), and there are no additional security measure sin place that need to be circumvented (AC:L), the attack does not rely on preconditions (AT:N). The attack does require authentication, but the level of authentication is irrelevant (PR:L), it does not require user interaction (UI:N). If is a full system compromise, potentially fully compromising confidentiality, integrity and availability of the devicer (VC:H/VI:H/VA:H).\u00a0 A compromised charger can be used to \"pivot\" onto networks that should otherwise be closed, cause a low confidentiality and interity impact on subsequent systems. (SC:L/SI:L/SA:H).\u00a0Because this device is an EV charger handing significant amounts of power, we suspect this vulnerability can have a safety impact (S:P). The attack can be automated (AU:Y)."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "PRESENT",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/S:P/AU:Y",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250: Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "description": "OWASP-A03: Injection",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-11T13:07:11.657Z",
        "orgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
        "shortName": "DIVD"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/DIVD-2024-00035/"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://csirt.divd.nl/CVE-2024-43648/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://iocharger.com"
        }
      ],
      "source": {
        "advisory": "DIVD-2024-00035",
        "discovery": "EXTERNAL"
      },
      "title": "Authenticated command injection via \u003credacted\u003e.exe \u003credacted\u003e parameter",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b87402ff-ae37-4194-9dae-31abdbd6f217",
    "assignerShortName": "DIVD",
    "cveId": "CVE-2024-43648",
    "datePublished": "2025-01-09T07:56:46.114Z",
    "dateReserved": "2024-08-14T09:27:41.767Z",
    "dateUpdated": "2025-03-11T13:07:11.657Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43405 (GCVE-0-2024-43405)

Vulnerability from cvelistv5 – Published: 2024-09-04 15:36 – Updated: 2024-09-04 16:21
VLAI
Title
Nuclei Template Signature Verification Bypass
Summary
Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template. The vulnerability is present in the template signature verification process, specifically in the `signer` package. The vulnerability stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, combined with the way multiple signatures are processed. This allows an attacker to inject malicious content into a template while maintaining a valid signature for the benign part of the template. CLI users are affected if they execute custom code templates from unverified sources. This includes templates authored by third parties or obtained from unverified repositories. SDK Users are affected if they are developers integrating Nuclei into their platforms, particularly if they permit the execution of custom code templates by end-users. The vulnerability is addressed in Nuclei v3.3.2. Users are strongly recommended to update to this version to mitigate the security risk. As an interim measure, users should refrain from using custom templates if unable to upgrade immediately. Only trusted, verified templates should be executed. Those who are unable to upgrade Nuclei should disable running custom code templates as a workaround.
Severity
7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
projectdiscovery nuclei Affected: >= 3.0.0, < 3.3.2
Create a notification for this product.
projectdiscovery nuclei Affected: 3.0.0 , < 3.3.2 (custom)
    cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:projectdiscovery:nuclei:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "nuclei",
            "vendor": "projectdiscovery",
            "versions": [
              {
                "lessThan": "3.3.2",
                "status": "affected",
                "version": "3.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43405",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T16:21:03.366044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T16:21:54.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nuclei",
          "vendor": "projectdiscovery",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei\u0027s template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code via custom code template. The vulnerability is present in the template signature verification process, specifically in the `signer` package. The vulnerability stems from a discrepancy between how the signature verification process and the YAML parser handle newline characters, combined with the way multiple signatures are processed. This allows an attacker to inject malicious content into a template while maintaining a valid signature for the benign part of the template. CLI users are affected if they execute custom code templates from unverified sources. This includes templates authored by third parties or obtained from unverified repositories. SDK Users are affected if they are developers integrating Nuclei into their platforms, particularly if they permit the execution of custom code templates by end-users. The vulnerability is addressed in Nuclei v3.3.2. Users are strongly recommended to update to this version to mitigate the security risk. As an interim measure, users should refrain from using custom templates if unable to upgrade immediately. Only trusted, verified templates should be executed. Those who are unable to upgrade Nuclei should disable running custom code templates as a workaround."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T15:36:23.277Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-7h5p-mmpp-hgmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-7h5p-mmpp-hgmm"
        },
        {
          "name": "https://github.com/projectdiscovery/nuclei/commit/0da993afe6d41b4b1b814e8fad23a2acba13c60a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/projectdiscovery/nuclei/commit/0da993afe6d41b4b1b814e8fad23a2acba13c60a"
        }
      ],
      "source": {
        "advisory": "GHSA-7h5p-mmpp-hgmm",
        "discovery": "UNKNOWN"
      },
      "title": "Nuclei Template Signature Verification Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43405",
    "datePublished": "2024-09-04T15:36:23.277Z",
    "dateReserved": "2024-08-12T18:02:04.966Z",
    "dateUpdated": "2024-09-04T16:21:54.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43402 (GCVE-0-2024-43402)

Vulnerability from cvelistv5 – Published: 2024-09-04 15:29 – Updated: 2024-09-04 15:50
VLAI
Title
Rust OS Command Injection/Argument Injection vulnerability
Summary
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For example, `.bat. .` is interpreted by Windows as `.bat`, but the original fix didn't check for that. Affected users who are using Rust 1.77.2 or greater can remove the trailing whitespace (ASCII 0x20) and trailing periods (ASCII 0x2E) from the batch file name to bypass the incomplete fix and enable the mitigations. Users are affected if their code or one of their dependencies invoke a batch script on Windows with trailing whitespace or trailing periods in the name, and pass untrusted arguments to it. Rust 1.81.0 will update the standard library to apply the CVE-2024-24576 mitigations to all batch files invocations, regardless of the trailing chars in the file name.
Severity
8.2 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
Impacted products
Vendor Product Version
rust-lang rust Affected: < 1.81.0
Create a notification for this product.
rust-lang rust Affected: 0 , < 1.81.0 (custom)
    cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:rust-lang:rust:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "rust",
            "vendor": "rust-lang",
            "versions": [
              {
                "lessThan": "1.81.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43402",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-04T15:46:50.324467Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-04T15:50:20.290Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rust",
          "vendor": "rust-lang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.81.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file name had trailing whitespace or periods (which are ignored and stripped by Windows). To determine whether to apply the `cmd.exe` escaping rules, the original fix for the vulnerability checked whether the command name ended with `.bat` or `.cmd`. At the time that seemed enough, as we refuse to invoke batch scripts with no file extension. Windows removes trailing whitespace and periods when parsing file paths. For example, `.bat. .` is interpreted by Windows as `.bat`, but the original fix didn\u0027t check for that. Affected users who are using Rust 1.77.2 or greater can remove the trailing whitespace (ASCII 0x20) and trailing periods (ASCII 0x2E) from the batch file name to bypass the incomplete fix and enable the mitigations. Users are affected if their code or one of their dependencies invoke a batch script on Windows with trailing whitespace or trailing periods in the name, and pass untrusted arguments to it. Rust 1.81.0 will update the standard library to apply the CVE-2024-24576 mitigations to all batch files invocations, regardless of the trailing chars in the file name."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-04T15:29:04.752Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rust-lang/rust/security/advisories/GHSA-2xg3-7mm6-98jj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rust-lang/rust/security/advisories/GHSA-2xg3-7mm6-98jj"
        },
        {
          "name": "https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.rust-lang.org/2024/04/09/cve-2024-24576.html"
        },
        {
          "name": "https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/file-folder-name-whitespace-characters",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/file-folder-name-whitespace-characters"
        }
      ],
      "source": {
        "advisory": "GHSA-2xg3-7mm6-98jj",
        "discovery": "UNKNOWN"
      },
      "title": "Rust OS Command Injection/Argument Injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-43402",
    "datePublished": "2024-09-04T15:29:04.752Z",
    "dateReserved": "2024-08-12T18:02:04.966Z",
    "dateUpdated": "2024-09-04T15:50:20.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43387 (GCVE-0-2024-43387)

Vulnerability from cvelistv5 – Published: 2024-09-10 08:43 – Updated: 2024-09-10 14:22
VLAI
Title
Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices
Summary
A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
PHOENIX CONTACT FL MGUARD 2102 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 2105 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4102 PCI Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4102 PCIE Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4302 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4305 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CORE TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CORE TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD DELTA TX/TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD GT/GT Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD GT/GT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCI4000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCI4000 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCIE4000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCIE4000 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2005 TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD SMART2 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD SMART2 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 3G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G VZW VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 3G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G ATT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G VZW VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
phoenixcontact fl_mguard_smart2_vpn_firmware Affected: 0 , < 8.9.3 (semver)
    cpe:2.3:o:phoenixcontact:fl_mguard_centerport_vpn-1000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\/tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_gt\/gt_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_gt\/gt_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\/tx-b_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2005_tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx-m_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx-p_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\/dtx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\/dtx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_smart2_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_smart2_vpn_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
phoenixcontact fl_mguard_4305_firmware Affected: 0 , < 10.4.1 (semver)
    cpe:2.3:o:phoenixcontact:fl_mguard_2102_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_2105_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4102_pcie_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4102_pci_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4302_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4305_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
phoenixcontact tc_mguard_rs4000_4g_vzw_vpn_firmware Affected: 0 , < 8.9.3 (semver)
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_3g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_3g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
Andrea Palanca Nozomi Networks Security Research Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:fl_mguard_centerport_vpn-1000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\\/tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_gt\\/gt_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_gt\\/gt_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\\/tx-b_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2005_tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx-m_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx-p_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\\/dtx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\\/dtx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_smart2_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_smart2_vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fl_mguard_smart2_vpn_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "8.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:fl_mguard_2102_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_2105_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4102_pcie_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4102_pci_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4302_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4305_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fl_mguard_4305_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "10.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_3g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_3g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tc_mguard_rs4000_4g_vzw_vpn_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "8.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43387",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T14:22:29.653702Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:22:52.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 2102",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 2105",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4102 PCI",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4102 PCIE",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4302",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4305",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CENTERPORT VPN-1000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CORE TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CORE TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD DELTA TX/TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD DELTA TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD GT/GT",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD GT/GT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCI4000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCI4000 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCIE4000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCIE4000 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2000 TX/TX-B",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2000 TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2005 TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX-M",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX-P",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4004 TX/DTX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4004 TX/DTX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD SMART2",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD SMART2 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 3G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G ATT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G VZW VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 3G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G ATT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G VZW VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Andrea Palanca"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nozomi Networks Security Research Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAIL_RELAY_PASSWORD in mGuard devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T08:43:54.155Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2024-039"
        }
      ],
      "source": {
        "advisory": "VDE-2024-039",
        "defect": [
          "CERT@VDE#641656"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2024-43387",
    "datePublished": "2024-09-10T08:43:54.155Z",
    "dateReserved": "2024-08-12T08:30:16.360Z",
    "dateUpdated": "2024-09-10T14:22:52.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43386 (GCVE-0-2024-43386)

Vulnerability from cvelistv5 – Published: 2024-09-10 08:43 – Updated: 2024-09-10 14:25
VLAI
Title
Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
Summary
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in mGuard devices.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
PHOENIX CONTACT FL MGUARD 2102 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 2105 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4102 PCI Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4102 PCIE Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4302 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4305 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CORE TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CORE TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD DELTA TX/TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD GT/GT Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD GT/GT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCI4000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCI4000 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCIE4000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCIE4000 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2005 TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD SMART2 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD SMART2 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 3G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G VZW VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 3G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G ATT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G VZW VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
phoenixcontact fl_mguard_smart2_vpn_firmware Affected: 0 , < 8.9.3 (semver)
    cpe:2.3:o:phoenixcontact:fl_mguard_centerport_vpn-1000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\/tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_gt\/gt_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_gt\/gt_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\/tx-b_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2005_tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx-m_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx-p_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\/dtx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\/dtx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_smart2_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_smart2_vpn_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
phoenixcontact fl_mguard_4305_firmware Affected: 0 , < 10.4.1 (semver)
    cpe:2.3:o:phoenixcontact:fl_mguard_2102_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_2105_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4102_pcie_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4102_pci_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4302_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4305_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
phoenixcontact tc_mguard_rs4000_4g_vzw_vpn_firmware Affected: 0 , < 8.9.3 (semver)
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_3g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_3g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
Andrea Palanca Nozomi Networks Security Research Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:fl_mguard_centerport_vpn-1000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\\/tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_gt\\/gt_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_gt\\/gt_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\\/tx-b_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2005_tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx-m_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx-p_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\\/dtx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\\/dtx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_smart2_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_smart2_vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fl_mguard_smart2_vpn_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "8.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:fl_mguard_2102_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_2105_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4102_pcie_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4102_pci_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4302_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4305_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fl_mguard_4305_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "10.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_3g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_3g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tc_mguard_rs4000_4g_vzw_vpn_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "8.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T14:25:00.255471Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:25:13.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 2102",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 2105",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4102 PCI",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4102 PCIE",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4302",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4305",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CENTERPORT VPN-1000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CORE TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CORE TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD DELTA TX/TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD DELTA TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD GT/GT",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD GT/GT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCI4000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCI4000 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCIE4000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCIE4000 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2000 TX/TX-B",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2000 TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2005 TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX-M",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX-P",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4004 TX/DTX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4004 TX/DTX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD SMART2",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD SMART2 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 3G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G ATT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G VZW VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 3G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G ATT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G VZW VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Andrea Palanca"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nozomi Networks Security Research Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in\u0026nbsp;mGuard devices.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAIL_NOTIFICATION.TO in\u00a0mGuard devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T08:43:41.392Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2024-039"
        }
      ],
      "source": {
        "advisory": "VDE-2024-039",
        "defect": [
          "CERT@VDE#641656"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in\u00a0mGuard devices.",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2024-43386",
    "datePublished": "2024-09-10T08:43:41.392Z",
    "dateReserved": "2024-08-12T08:30:16.359Z",
    "dateUpdated": "2024-09-10T14:25:13.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43385 (GCVE-0-2024-43385)

Vulnerability from cvelistv5 – Published: 2024-09-10 08:43 – Updated: 2024-09-10 14:25
VLAI
Title
Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devices
Summary
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY_HTTP_PORT in mGuard devices.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
PHOENIX CONTACT FL MGUARD 2102 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 2105 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4102 PCI Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4102 PCIE Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4302 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD 4305 Affected: 0 , < 10.4.1 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CENTERPORT VPN-1000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CORE TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD CORE TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD DELTA TX/TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD DELTA TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD GT/GT Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD GT/GT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCI4000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCI4000 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCIE4000 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD PCIE4000 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2000 TX/TX-B Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2000 TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS2005 TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-M Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX-P Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4000 TX/TX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD RS4004 TX/DTX VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD SMART2 Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT FL MGUARD SMART2 VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 3G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G ATT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS2000 4G VZW VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 3G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G ATT VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
PHOENIX CONTACT TC MGUARD RS4000 4G VZW VPN Affected: 0 , < 8.9.3 (semver)
Create a notification for this product.
phoenixcontact fl_mguard_smart2_vpn_firmware Affected: 0 , < 8.9.3 (semver)
    cpe:2.3:o:phoenixcontact:fl_mguard_centerport_vpn-1000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\/tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_gt\/gt_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_gt\/gt_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\/tx-b_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs2005_tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx-m_firmware:-:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx-p_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\/tx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\/dtx_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\/dtx_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_smart2_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_smart2_vpn_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
phoenixcontact fl_mguard_4305_firmware Affected: 0 , < 10.4.1 (semver)
    cpe:2.3:o:phoenixcontact:fl_mguard_2102_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_2105_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4102_pcie_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4102_pci_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4302_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:fl_mguard_4305_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
phoenixcontact tc_mguard_rs4000_4g_vzw_vpn_firmware Affected: 0 , < 8.9.3 (semver)
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_3g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_3g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
Andrea Palanca Nozomi Networks Security Research Team
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:fl_mguard_centerport_vpn-1000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_core_tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\\/tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_delta_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_gt\\/gt_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_gt\\/gt_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pci4000_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_pcie4000_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\\/tx-b_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2000_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs2005_tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx-m_firmware:-:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx-p_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4000_tx\\/tx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\\/dtx_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_rs4004_tx\\/dtx_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_smart2_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_smart2_vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fl_mguard_smart2_vpn_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "8.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:fl_mguard_2102_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_2105_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4102_pcie_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4102_pci_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4302_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:fl_mguard_4305_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "fl_mguard_4305_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "10.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_3g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs2000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_3g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_att_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:phoenixcontact:tc_mguard_rs4000_4g_vzw_vpn_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "tc_mguard_rs4000_4g_vzw_vpn_firmware",
            "vendor": "phoenixcontact",
            "versions": [
              {
                "lessThan": "8.9.3",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-43385",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T14:25:23.534617Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-10T14:25:30.320Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 2102",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 2105",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4102 PCI",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4102 PCIE",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4302",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD 4305",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "10.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CENTERPORT VPN-1000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CORE TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD CORE TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD DELTA TX/TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD DELTA TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD GT/GT",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD GT/GT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCI4000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCI4000 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCIE4000",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD PCIE4000 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2000 TX/TX-B",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2000 TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS2005 TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX-M",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX-P",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4000 TX/TX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4004 TX/DTX",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD RS4004 TX/DTX VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD SMART2",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "FL MGUARD SMART2 VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 3G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G ATT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS2000 4G VZW VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 3G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G ATT VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "TC MGUARD RS4000 4G VZW VPN",
          "vendor": "PHOENIX CONTACT",
          "versions": [
            {
              "lessThan": "8.9.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Andrea Palanca"
        },
        {
          "lang": "en",
          "type": "reporter",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Nozomi Networks Security Research Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA low privileged remote attacker can trigger the\u0026nbsp;execution of arbitrary OS commands as root due to improper neutralization of special elements in\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethe variable PROXY_HTTP_PORT in\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003emGuard devices.\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A low privileged remote attacker can trigger the\u00a0execution of arbitrary OS commands as root due to improper neutralization of special elements in\u00a0the variable PROXY_HTTP_PORT in\u00a0mGuard devices."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78:Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-10T08:43:25.556Z",
        "orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
        "shortName": "CERTVDE"
      },
      "references": [
        {
          "url": "https://cert.vde.com/en/advisories/VDE-2024-039"
        }
      ],
      "source": {
        "advisory": "VDE-2024-039",
        "defect": [
          "CERT@VDE#641656"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Phoenix Contact: OS command execution through PROXY_HTTP_PORT in\u00a0mGuard devices",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c",
    "assignerShortName": "CERTVDE",
    "cveId": "CVE-2024-43385",
    "datePublished": "2024-09-10T08:43:25.556Z",
    "dateReserved": "2024-08-12T08:30:16.359Z",
    "dateUpdated": "2024-09-10T14:25:30.320Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-42370 (GCVE-0-2024-42370)

Vulnerability from cvelistv5 – Published: 2024-08-09 18:29 – Updated: 2024-08-19 21:05
VLAI
Title
Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow
Summary
Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue.
Severity
8.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
litestar-org litestar Affected: <= 2.10.0
Create a notification for this product.
litestar-org litestar Affected: 0 , ≤ 2.10.0 (custom)
    cpe:2.3:a:litestar-org:litestar:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:litestar-org:litestar:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "litestar",
            "vendor": "litestar-org",
            "versions": [
              {
                "lessThanOrEqual": "2.10.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42370",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T15:02:38.424647Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T17:33:06.569Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "litestar",
          "vendor": "litestar-org",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.10.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar\u0027s `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-19T21:05:05.131Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/litestar-org/litestar/security/advisories/GHSA-4hq2-rpgc-r8r7"
        },
        {
          "name": "https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litestar-org/litestar/commit/84d351e96aaa2a1338006d6e7221eded161f517b"
        },
        {
          "name": "https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litestar-org/litestar/actions/runs/10081936962/job/27875077668#step:1:17"
        },
        {
          "name": "https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/litestar-org/litestar/blob/ffaf5616b19f6f0f4128209c8b49dbcb41568aa2/.github/workflows/docs-preview.yml"
        }
      ],
      "source": {
        "advisory": "GHSA-4hq2-rpgc-r8r7",
        "discovery": "UNKNOWN"
      },
      "title": "Litestar repository vulnerable to Environment Variable injection in `docs-preview.yml` workflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-42370",
    "datePublished": "2024-08-09T18:29:11.205Z",
    "dateReserved": "2024-07-30T14:01:33.923Z",
    "dateUpdated": "2024-08-19T21:05:05.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-42167 (GCVE-0-2024-42167)

Vulnerability from cvelistv5 – Published: 2024-08-12 11:38 – Updated: 2024-08-12 14:20
VLAI
Title
Command Injection in Organisationname
Summary
The function "generate_app_certificates" in controllers/saml2/saml2.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
FIWARE FIWARE Keyrock Affected: 0 , ≤ 8.4 (custom)
Create a notification for this product.
fiware keyrock Affected: 0 , ≤ 8.4 (custom)
    cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
Wolfgang Hotwagner (Austrian Institute of Technology)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "keyrock",
            "vendor": "fiware",
            "versions": [
              {
                "lessThanOrEqual": "8.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T14:02:57.512640Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T14:20:39.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FIWARE Keyrock",
          "vendor": "FIWARE",
          "versions": [
            {
              "lessThanOrEqual": "8.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wolfgang Hotwagner (Austrian Institute of Technology)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The function \"generate_app_certificates\" in controllers/saml2/saml2.js of FIWARE Keyrock \u0026lt;= 8.4\u0026nbsp;does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname."
            }
          ],
          "value": "The function \"generate_app_certificates\" in controllers/saml2/saml2.js of FIWARE Keyrock \u003c= 8.4\u00a0does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious organisationname."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-12T11:38:35.988Z",
        "orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
        "shortName": "CyberDanube"
      },
      "references": [
        {
          "url": "https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Command Injection in Organisationname",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
    "assignerShortName": "CyberDanube",
    "cveId": "CVE-2024-42167",
    "datePublished": "2024-08-12T11:38:35.988Z",
    "dateReserved": "2024-07-29T20:49:58.925Z",
    "dateUpdated": "2024-08-12T14:20:39.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-42166 (GCVE-0-2024-42166)

Vulnerability from cvelistv5 – Published: 2024-08-12 11:36 – Updated: 2024-08-12 13:46
VLAI
Title
Command Injection in Applicationname
Summary
The function "generate_app_certificates" in lib/app_certificates.js of FIWARE Keyrock <= 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
FIWARE FIWARE Keyrock Affected: 0 , ≤ 8.4 (custom)
Create a notification for this product.
fiware keyrock Affected: 0 , ≤ 8.4 (custom)
    cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
Wolfgang Hotwagner (Austrian Institute of Technology)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:fiware:keyrock:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "keyrock",
            "vendor": "fiware",
            "versions": [
              {
                "lessThanOrEqual": "8.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-12T13:38:25.936495Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-12T13:46:39.901Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FIWARE Keyrock",
          "vendor": "FIWARE",
          "versions": [
            {
              "lessThanOrEqual": "8.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wolfgang Hotwagner (Austrian Institute of Technology)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The function \"generate_app_certificates\" in lib/app_certificates.js of FIWARE Keyrock \u0026lt;= 8.4 does not\u0026nbsp;neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name."
            }
          ],
          "value": "The function \"generate_app_certificates\" in lib/app_certificates.js of FIWARE Keyrock \u003c= 8.4 does not\u00a0neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious name."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-12T11:36:28.386Z",
        "orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
        "shortName": "CyberDanube"
      },
      "references": [
        {
          "url": "https://www.ait.ac.at/themen/cyber-security/pentesting/security-advisories"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Command Injection in Applicationname",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc",
    "assignerShortName": "CyberDanube",
    "cveId": "CVE-2024-42166",
    "datePublished": "2024-08-12T11:36:28.386Z",
    "dateReserved": "2024-07-29T20:49:58.925Z",
    "dateUpdated": "2024-08-12T13:46:39.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-42060 (GCVE-0-2024-42060)

Vulnerability from cvelistv5 – Published: 2024-09-03 01:54 – Updated: 2024-09-03 13:43
VLAI
Summary
A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device.
Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Zyxel ATP series firmware Affected: versions V4.32 through V5.38
Create a notification for this product.
Zyxel USG FLEX series firmware Affected: versions V4.50 through V5.38
Create a notification for this product.
Zyxel USG FLEX 50(W) series firmware Affected: versions V4.16 through V5.38
Create a notification for this product.
Zyxel USG20(W)-VPN series firmware Affected: versions V4.16 through V5.38
Create a notification for this product.
zyxel atp800_firmware Affected: 4.32 , ≤ 5.38 (custom)
    cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
zyxel usg_flex_700h_firmware Affected: 4.5 , ≤ 5.38 (custom)
    cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
zyxel usg_flex_50w_firmware Affected: 4.16 , ≤ 5.38 (custom)
    cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:zyxel:atp100_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp100w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp700_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:atp800_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "atp800_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.38",
                "status": "affected",
                "version": "4.32",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg_flex_100ax_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_100w_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_200h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_500h_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_50ax_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_50_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_700h_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_700h_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.38",
                "status": "affected",
                "version": "4.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:zyxel:usg20w-vpn_firmware:*:*:*:*:*:*:*:*",
              "cpe:2.3:o:zyxel:usg_flex_50w_firmware:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "usg_flex_50w_firmware",
            "vendor": "zyxel",
            "versions": [
              {
                "lessThanOrEqual": "5.38",
                "status": "affected",
                "version": "4.16",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42060",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-03T13:07:39.814236Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-03T13:43:44.353Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ATP series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V4.32 through V5.38"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V4.50 through V5.38"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG FLEX 50(W) series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V4.16 through V5.38"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "USG20(W)-VPN series firmware",
          "vendor": "Zyxel",
          "versions": [
            {
              "status": "affected",
              "version": "versions V4.16 through V5.38"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device."
            }
          ],
          "value": "A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware versions from V4.50 through V5.38, USG FLEX 50(W) series firmware versions from V4.16 through V5.38, and USG20(W)-VPN series firmware versions from V4.16 through V5.38 could allow an authenticated attacker with administrator privileges to execute some OS commands on an affected device by uploading a crafted internal user agreement file to the vulnerable device."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-03T01:54:57.221Z",
        "orgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
        "shortName": "Zyxel"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-multiple-vulnerabilities-in-firewalls-09-03-2024"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "96e50032-ad0d-4058-a115-4d2c13821f9f",
    "assignerShortName": "Zyxel",
    "cveId": "CVE-2024-42060",
    "datePublished": "2024-09-03T01:54:57.221Z",
    "dateReserved": "2024-07-29T02:36:19.275Z",
    "dateUpdated": "2024-09-03T13:43:44.353Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}
Mitigation
Architecture and Design

If at all possible, use library calls rather than external processes to recreate the desired functionality.

Mitigation MIT-22
Architecture and Design Operation

Strategy: Sandbox or Jail

  • Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.
  • OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations.
  • This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise.
  • Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation
Architecture and Design

Strategy: Attack Surface Reduction

For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.

Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-4.3
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to error.
Mitigation MIT-28
Implementation

Strategy: Output Encoding

While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).

Mitigation
Implementation

If the program to be executed allows arguments to be specified within an input file or from standard input, then consider using that mode to pass arguments instead of the command line.

Mitigation MIT-27
Architecture and Design

Strategy: Parameterization

  • If available, use structured mechanisms that automatically enforce the separation between data and code. These mechanisms may be able to provide the relevant quoting, encoding, and validation automatically, instead of relying on the developer to provide this capability at every point where output is generated.
  • Some languages offer multiple functions that can be used to invoke commands. Where possible, identify any function that invokes a command shell using a single string, and replace it with a function that requires individual arguments. These functions typically perform appropriate quoting and filtering of arguments. For example, in C, the system() function accepts a string that contains the entire command to be executed, whereas execl(), execve(), and others require an array of strings, one for each argument. In Windows, CreateProcess() only accepts one command at a time. In Perl, if system() is provided with an array of arguments, then it will quote each of the arguments.
Mitigation MIT-5
Implementation

Strategy: Input Validation

  • Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
  • When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
  • Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
  • When constructing OS command strings, use stringent allowlists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack, but this technique is less important than proper output encoding and escaping.
  • Note that proper output encoding, escaping, and quoting is the most effective solution for preventing OS command injection, although input validation may provide some defense-in-depth. This is because it effectively limits what will appear in output. Input validation will not always prevent OS command injection, especially if you are required to support free-form text fields that could contain arbitrary characters. For example, when invoking a mail program, you might need to allow the subject field to contain otherwise-dangerous inputs like ";" and ">" characters, which would need to be escaped or otherwise handled. In this case, stripping the character might reduce the risk of OS command injection, but it would produce incorrect behavior because the subject field would not be recorded as the user intended. This might seem to be a minor inconvenience, but it could be more important when the program relies on well-structured subject lines in order to pass messages to other components.
  • Even if you make a mistake in your validation (such as forgetting one out of 100 input fields), appropriate encoding is still likely to protect you from injection-based attacks. As long as it is not done in isolation, input validation is still a useful technique, since it may significantly reduce your attack surface, allow you to detect some attacks, and provide other security benefits that proper encoding does not address.
Mitigation MIT-21
Architecture and Design

Strategy: Enforcement by Conversion

When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.

Mitigation MIT-32
Operation

Strategy: Compilation or Build Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-32
Operation

Strategy: Environment Hardening

Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).

Mitigation MIT-39
Implementation
  • Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.
  • If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.
  • Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
  • In the context of OS Command Injection, error information passed back to the user might reveal whether an OS command is being executed and possibly which command is being used.
Mitigation
Operation

Strategy: Sandbox or Jail

Use runtime policy enforcement to create an allowlist of allowable commands, then prevent use of any command that does not appear in the allowlist. Technologies such as AppArmor are available to do this.

Mitigation MIT-29
Operation

Strategy: Firewall

Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Mitigation MIT-17
Architecture and Design Operation

Strategy: Environment Hardening

Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.

Mitigation MIT-16
Operation Implementation

Strategy: Environment Hardening

When using PHP, configure the application so that it does not use register_globals. During implementation, develop the application so that it does not rely on this feature, but be wary of implementing a register_globals emulation that is subject to weaknesses such as CWE-95, CWE-621, and similar issues.

CAPEC-108: Command Line Execution through SQL Injection

An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

CAPEC-15: Command Delimiters

An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or denylist input validation, as opposed to allowlist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or denylist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.

CAPEC-43: Exploiting Multiple Input Interpretation Layers

An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: <parser1> --> <input validator> --> <parser2>. In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.

CAPEC-6: Argument Injection

An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.

CAPEC-88: OS Command Injection

In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

← Back to the CWE list