RCE in Ligowave Apc Propeller
CVE-2024-4999
A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.122 (96.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.122 · newest: 0.122 · change: 0.000
Affected products
- Ligowave Apc Propeller — versions 0
- Ligowave Mimo — versions 0
- Ligowave Pro — versions 0
- Ligowave Unity — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- onekey.com/blog/security-advisory-remote-code-execution-in-ligowave-devices/ (third-party-advisory)
Frequently asked questions
- What is CVE-2024-4999?
- CVE-2024-4999 is a vulnerability in Ligowave Apc Propeller, classified under Command Injection. Published 2024-05-16.
- Is CVE-2024-4999 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.