by Kastro
Paper/Archive/CVE-2024-8997

CVE-2024-8997

Vestel EVC04 Configuration Interface — SQLi in Vestel's EVC04 Configuration Interface

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 37.7.377 × 207.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Vestel EVC04 Configuration Interface allows SQL Injection. This issue affects EVC04 Configuration Interface: before V3.187, V4.53.

Affected

ProductAffectedFixed inSource
EVC04 Configuration Interface< V3.187, V4.53V3.187, V4.53CNA

Scores by source

TR-CERT (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refusom.gov.tr/bildirim/tr-25-0070refsiberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0070