RCE in 4ipnet Eap-767
CVE-2024-24301
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privilege…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.021 (79.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- 4ipnet Eap-767
- 4ipnet Eap-767_firmware — versions 3.42.00
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2024-24301?
- CVE-2024-24301 is a high-severity vulnerability in 4ipnet Eap-767, classified under Command Injection. CVSS score: 8.8/10. Published 2024-02-14.
- How severe is CVE-2024-24301?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-24301 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.