CVE-2024-2162
Assigner: NCSC.ch
Published: 2024-03-21T06:00:35.823Z
State: PUBLISHED
affected: defaultStatus: affected
product: NDI
vendor: Kiloview
versions: status: unaffected
version: N3 Firmware 2.02.0227
status: unaffected
version: N3-s Firmware 2.02.0227
status: unaffected
version: N4 Firmware 2.02.0227
status: unaffected
version: N20 Firmware 2.02.0227
status: unaffected
version: N30 Firmware 2.02.0227
status: unaffected
version: N40 Firmware 2.02.0227
credits: type: finder
value: Milan Duric, EBU
descriptions: supportingMedia: base64: no
type: text/html
value: An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges.<p></p><p>This issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .</p><p></p>
value: An OS Command Injection vulnerability in Kiloview NDI allows a low-privileged user to execute arbitrary code remotely on the device with high privileges.

This issue affects Kiloview NDI N3, N3-s, N4, N20, N30, N40 and was fixed in Firmware version 2.02.0227 .


impacts: capecId: CAPEC-233
descriptions: value: CAPEC-233 Privilege Escalation
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Upgrade to the firmware  2.02.0227 or later<br>
value: Upgrade to the firmware  2.02.0227 or later

source: discovery: EXTERNAL
title: Authenticated Remote Code Execution in Kiloview NDI N series products
workarounds: supportingMedia: base64: no
type: text/html
value: Restrict access to the 
management interface of all affected Kiloview devices by applying strict firewall rules or other available means.
<br><br>
value: Restrict access to the 
management interface of all affected Kiloview devices by applying strict firewall rules or other available means.


x_generator: engine: Vulnogram 0.1.0-dev