What is CVE-2024-13502?

CVE-2024-13502 is a vulnerability in Newtec/idirect Ntc2218, Ntc2250, Ntc2299, classified under OS Command Injection. Published 2025-01-17.

Is CVE-2024-13502 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Newtec/idirect Ntc2218, Ntc2250, Ntc2299

CVE-2024-13502

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Newtec/iDirect NTC2218, NTC2250, NTC2299 on Linux, PowerPC, ARM allows Local Code Inclusion.This issue affects NTC2218, NTC2250, NTC2299: from 1.0.1.1 through 2.2.6.19. The `commit_multicast` page used to configure multicasts in the modem's web administration interface uses improperly parses incoming data from the request before passing it to an `eval` statement in a bash script. This allows attackers to inject arbitrary shell commands.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.006 (46.3th percentile) — read the EPSS interpretation.

Affected products

Newtec/idirect Ntc2218, Ntc2250, Ntc2299 — versions 1.0.1.1

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

Frequently asked questions

What is CVE-2024-13502?: CVE-2024-13502 is a vulnerability in Newtec/idirect Ntc2218, Ntc2250, Ntc2299, classified under OS Command Injection. Published 2025-01-17.
Is CVE-2024-13502 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.