CVE-2024-10118CWE-78

SECOM WRTR-304GN-304TW-UPSC - OS Command Injection

Critical · published October 18, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
58.9
In the wild
Unconfirmed
What it is

🚨 Unauthenticated attackers can unleash chaos with a single command! The SECOM WRTR-304GN-304TW-UPSC device is wide open, allowing remote command injection without a single login. 🔥 Think of this vulnerability like a restaurant where anyone can walk into the kitchen and start cooking without any authorization — it's a recipe for disaster! An attacker could easily turn a simple dish into a toxic mess, wreaking havoc on the entire establishment. This flaw is absolutely devastating; an attacker could take complete control of the device, running arbitrary commands that could compromise your entire network. Imagine an intruder disabling security features or snooping on sensitive information — the fallout could be catastrophic!

Put simply

Think of this vulnerability like a restaurant where anyone can walk into the kitchen and start cooking without any authorization — it's a recipe for disaster! An attacker could easily turn a simple dish into a toxic mess, wreaking havoc on the entire establishment. This vulnerability arises from improper input filtering within the SECOM WRTR-304GN-304TW-UPSC, allowing unauthenticated users to execute arbitrary system commands remotely on the device.

What to do

This flaw is absolutely devastating; an attacker could take complete control of the device, running arbitrary commands that could compromise your entire network. Imagine an intruder disabling security features or snooping on sensitive information — the fallout could be catastrophic! Immediate action is essential! First, disconnect the device from the network to prevent any potential exploitation while you investigate. Next, apply the latest firmware updates provided by SECOM to patch this critical vulnerability. Finally, review your network security policies to ensure this device is monitored closely in the future. You've got this! By following these steps, you can protect your assets and keep your network safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00889 · 58.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-10-18T04:03Z
EPSS history
Timeline
  • 18 OCT 04:03Z
    SECOM WRTR-304GN-304TW-UPSC - OS Command Injection
    cvelistv5