CVE-2024-10119CWE-78

SECOM WRTM326 - OS Command Injection

Critical · published October 18, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
60.9
In the wild
Unconfirmed
What it is

🚨 A sneaky parameter vulnerability in the SECOM WRTM326 router could let an attacker remotely command your device without a password! 🔥 Think of it like a delivery person gaining access to your house just by pretending to be someone familiar—no key required. That’s how an unauthenticated attacker could slip in and execute commands on your router with just a crafted request! If exploited, an attacker could take control of your router, potentially intercepting your internet traffic, accessing sensitive data, or even turning your device into a part of a botnet. Imagine someone having free reign over your network—changing settings, spying on communications, and wreaking havoc! This could be absolutely devastating for your security!

Put simply

Think of it like a delivery person gaining access to your house just by pretending to be someone familiar—no key required. That’s how an unauthenticated attacker could slip in and execute commands on your router with just a crafted request! This vulnerability arises from the WRTM326's failure to validate a specific incoming parameter properly, allowing remote attackers to execute arbitrary system commands without authentication.

What to do

If exploited, an attacker could take control of your router, potentially intercepting your internet traffic, accessing sensitive data, or even turning your device into a part of a botnet. Imagine someone having free reign over your network—changing settings, spying on communications, and wreaking havoc! This could be absolutely devastating for your security! To protect your network, immediately update your WRTM326 router to the latest firmware released by SECOM. Additionally, consider changing your admin password as a precautionary measure, and review your security settings for enhanced protection. You've got this! Follow these steps, and you’ll be well on your way to keeping your network safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00951 · 60.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-10-18T04:09Z
EPSS history
Timeline
  • 18 OCT 04:09Z
    SECOM WRTM326 - OS Command Injection
    cvelistv5