CVE-2024-4999
Assigner: ONEKEY
Published: 2024-05-16T12:14:51.671Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: UNITY
vendor: Ligowave
versions: lessThanOrEqual: 6.95-2
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: PRO
vendor: Ligowave
versions: lessThanOrEqual: 6.95-1.rt3883
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: MIMO
vendor: Ligowave
versions: lessThanOrEqual: 6.95-1.rt2880
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: APC Propeller
vendor: Ligowave
versions: lessThanOrEqual: 2-5.95-4.rt3352
status: affected
version: 0
versionType: semver
credits: type: finder
value: Quentin Kaiser from ONEKEY Research Labs
descriptions: supportingMedia: base64: no
type: text/html
value: A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote&nbsp;attacker to execute arbitrary commands with elevated privileges.<p>This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.</p>
value: A vulnerability in the web-based management interface of multiple Ligowave devices could allow an authenticated remote attacker to execute arbitrary commands with elevated privileges.This issue affects UNITY: through 6.95-2; PRO: through 6.95-1.Rt3883; MIMO: through 6.95-1.Rt2880; APC Propeller: through 2-5.95-4.Rt3352.
impacts: capecId: CAPEC-88
descriptions: value: CAPEC-88 OS Command Injection
metrics: cvssV4_0: Automatable: YES
Recovery: USER
Safety: NEGLIGIBLE
attackComplexity: LOW
attackRequirements: NONE
attackVector: NETWORK
baseScore: 9.4
baseSeverity: CRITICAL
privilegesRequired: HIGH
providerUrgency: AMBER
subAvailabilityImpact: HIGH
subConfidentialityImpact: HIGH
subIntegrityImpact: HIGH
userInteraction: NONE
valueDensity: DIFFUSE
vectorString: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:M/U:Amber
version: 4.0
vulnAvailabilityImpact: HIGH
vulnConfidentialityImpact: HIGH
vulnIntegrityImpact: HIGH
vulnerabilityResponseEffort: MODERATE
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: CWE
source: discovery: UNKNOWN
title: Ligowave Unity/Pro/Mimo/APC Arbitrary Command Injection
workarounds: supportingMedia: base64: no
type: text/html
value: This product being EOL, Ligowave will not patch the vulnerability. If replacement of the EOL device is not possible, ensure access to the administration interface is restricted to administration network zones only, to reduce likelihood of exploitation.
value: This product being EOL, Ligowave will not patch the vulnerability. If replacement of the EOL device is not possible, ensure access to the administration interface is restricted to administration network zones only, to reduce likelihood of exploitation.
x_generator: engine: Vulnogram 0.2.0