by Kastro
Paper/Archive/CVE-2024-9166

CVE-2024-9166

Atelmo Atemio AM 520 HD Full HD Satellite Receiver — OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

EPSS 2%CVSS 9.3
critical.is priorityof 100
43
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 75.5.755 × 2015.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.

Affected

ProductAffectedFixed inSource
Atemio AM 520 HD Full HD Satellite Receiver≤ TitanNit 2.01–CNA
atemio_am_520_hd_firmware≤ titannit_2.01–CISA-ADP

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-24-270-03