exploitDog

CVE-2024-9054

Опубликовано: 04 окт. 2024

Источник: nvd

CVSS3: 8.8

EPSS Средний

Описание

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

Ссылки

https://www.gruppotim.it/it/footer/red-team.html
Exploit
Third Party Advisory
https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timeprovider-4100-grandmaster-rce-through-configuration-file
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:microchip:timeprovider_4100_firmware:*:*:*:*:*:*:*:*

Версия от 1.0 (включая) до 2.4.7 (исключая)

cpe:2.3:h:microchip:timeprovider_4100:-:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.21539

Средний

8.8 High

CVSS3

Дефекты

CWE-78

CWE-78

Связанные уязвимости

GHSA-69rg-jv6m-76wg

CVSS3: 8.8

github

больше 1 года назад

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

EPSS

Процентиль: 96%

0.21539

Средний

8.8 High

CVSS3

Дефекты

CWE-78

CWE-78