CVE-2024-2415CWE-78

Command injection vulnerability in Movistar 4G router

High · published March 13, 2024

CVSS v3.1
7.8
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

Command injection vulnerability in Movistar 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an authenticated user to execute commands inside the router by making a POST request to the URL '/cgi-bin/gui.cgi'.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00739 · 54.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2024-03-13T11:18Z
EPSS history
Timeline
  • 13 MAR 11:18Z
    Command injection vulnerability in Movistar 4G router
    cvelistv5