RCE in Newtec/idirect Ntc2218, Ntc2250, Ntc2299

CVE-2024-13502

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM allows Local Code Inclusion.This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The `commit_multicast` page used to configure multicasts in the modem's web administration interface uses improperly parses incoming data from the request before passing it to an `eval` statement in a bash script. This allows attackers to inject arbitrary shell commands.

Vulnerability class: Command Injection (OS Command Injection)

Published · last modified .

EPSS exploit prediction

EPSS: 0.006 (48.4th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 48.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2024-13502: held from 0.006 to 0.006.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2024-13502?
CVE-2024-13502 is a vulnerability in Newtec/idirect Ntc2218, Ntc2250, Ntc2299, classified under OS Command Injection. Published 2025-01-17.
Is CVE-2024-13502 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.