by Kastro
Paper/Archive/CVE-2024-6699

CVE-2024-6699

Mikafon Electronic Inc. Mikafon MA7 — SQLi in Mikafon Electronic's Mikafon MA7

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.7.367 × 207.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mikafon Electronic Inc. Mikafon MA7 allows SQL Injection. This issue affects Mikafon MA7: from v3.0 before v3.1.

Affected

ProductAffectedFixed inSource
Mikafon MA7v3.0 – < v3.1v3.1CNA
mikafon_ma7_firmware3.0 – < 3.13.1CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
TR-CERT (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refusom.gov.tr/bildirim/tr-24-1105refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0322