Paper/Archive/CVE-2024-1839

CVE-2024-1839

Intrado 911 Emergency Gateway (EGW) — Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthent…

EPSS 0.5%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (CNA)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 45.4.454 × 209.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Intrado 911 Emergency Gateway login form is vulnerable to an unauthenticated blind time-based SQL injection, which may allow an unauthenticated remote attacker to execute malicious code, exfiltrate data, or manipulate the database.

Affected

ProductAffectedFixed inSource

911 Emergency Gateway (EGW)All–CNA

911_emergency_gateway< 5.55.5CISA-ADP

911_emergency_gateway< 5.65.6CISA-ADP

Scores by source

cisa-cg (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

cisa-cg (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/S:P/AU:Y/R:U/V:C

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-163-04