What is CVE-2024-28027?

CVE-2024-28027 is a high-severity vulnerability in Mc Technologies Lr Router, classified under OS Command Injection. CVSS score: 7.2/10. Published 2024-11-21.

How severe is CVE-2024-28027?

High severity. CVSS v3 base score is 7.2 out of 10.

RCE in Mc Technologies Lr Router

CVE-2024-28027

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authetnicated OS Command injection that occurs through the attacker-controlled `timer1` parameter, at offset `0x8e80`.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.075 (94.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Mc Technologies Lr Router — versions 2.10.5 (QEMU)
Mc-technologies Mc_lr_router
Mc-technologies Mc_lr_router_firmware — versions 2.10.5

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

talos-cna@cisco.com (Exploit, Third Party Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2024-28027?: CVE-2024-28027 is a high-severity vulnerability in Mc Technologies Lr Router, classified under OS Command Injection. CVSS score: 7.2/10. Published 2024-11-21.
How severe is CVE-2024-28027?: High severity. CVSS v3 base score is 7.2 out of 10.