What is CVE-2024-45242?

CVE-2024-45242 is a high-severity vulnerability in N/a, classified under OS Command Injection. CVSS score: 7.8/10. Published 2024-10-24.

How severe is CVE-2024-45242?

High severity. CVSS v3 base score is 7.8 out of 10.

Is CVE-2024-45242 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in N/a

CVE-2024-45242

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credentials of admin/admin. An unauthorized attacker in proximity to the Wi-Fi network can exploit this window of time to execute arbitrary OS commands with root-level permissions.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.345 (98.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

N/a — versions n/a

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

actuator/cve

References

Frequently asked questions

What is CVE-2024-45242?: CVE-2024-45242 is a high-severity vulnerability in N/a, classified under OS Command Injection. CVSS score: 7.8/10. Published 2024-10-24.
How severe is CVE-2024-45242?: High severity. CVSS v3 base score is 7.8 out of 10.
Is CVE-2024-45242 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.