by Kastro
Paper/Archive/CVE-2024-37023

CVE-2024-37023

Vonets VAR1200-H — Vonets WiFi Bridges Command Injection

EPSS 1%CVSS 9.9
critical.is priorityof 100
44
CVSS 9.9 (NVD)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 69.6.696 × 2013.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters.

Affected

ProductAffectedFixed inSource
VAR1200-H≤ 3.3.23.6.9–CNA
VAR1200-L≤ 3.3.23.6.9–CNA
VAR600-H≤ 3.3.23.6.9–CNA
VAP11AC≤ 3.3.23.6.9–CNA
VAP11G-500S≤ 3.3.23.6.9–CNA
VBG1200≤ 3.3.23.6.9–CNA
VAP11S-5G≤ 3.3.23.6.9–CNA
VAP11S≤ 3.3.23.6.9–CNA
VAR11N-300≤ 3.3.23.6.9–CNA
VAP11G-300≤ 3.3.23.6.9–CNA
VAP11N-300≤ 3.3.23.6.9–CNA
VAP11G≤ 3.3.23.6.9–CNA

Scores by source

NVD9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
icscert (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-214-08