CVE-2024-7120CWE-78

Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection

Medium · published July 26, 2024

Patch now

High probability of exploitation

CVSS calls it medium at 5.3. It sits in the 99.8th percentile for exploit probability.

CVSS v4.0

5.3

EPSS

93%

Percentile

99.8

In the wild

Unconfirmed

What it is

A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.

The record

Technical detail

CVSS v4.0: 5.3 · MEDIUM
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS: 0.93400 · 99.8th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2024-07-26T05:00Z

EPSS history

Timeline

26 JUL 05:00Z
Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection
cvelistv5