CVE-2024-43778 Command injection in AHD04T-A
Remote authenticated attackers can execute arbitrary OS commands or alter settings on TAKENAKA digital video recorders.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-43778?
CVE-2024-43778 is a high-severity command injection vulnerability in TAKENAKA ENGINEERING CO., LTD. AHD04T-A, published on 18 Sep 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
OS command injection vulnerability in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Weakness: CWE-78
Which versions are affected by CVE-2024-43778?
How do I fix CVE-2024-43778?
No fix has been published for CVE-2024-43778 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-43778 being exploited?
There is no known exploitation of CVE-2024-43778 in the wild and no public exploit code.
Sources
Also known as GHSA-wpx8-pm5v-8hrp.