Paper/Archive/CVE-2024-26519

CVE-2024-26519

casa_systems ntc-221_firmware — An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to…

EPSS 0.3%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (ADP)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 22.2.222 × 204.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

ntc-221_firmware≤ 2.0.99.0–CISA-ADP

Scores by source

CISA ADP9.0CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcybercx.com.au/blog/zero-day-rce-in-netcomm-ntc-221-industrial-iot-m2m-lte-4g-router