CVE-2024-48073 Command injection in n/a
Attackers can exploit command injection in the update program to gain root privileges on sunniwell HT3300 devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-48073?
CVE-2024-48073 is a critical command injection vulnerability in n/a, published on 8 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges.
Weakness: CWE-862
Which versions are affected by CVE-2024-48073?
How do I fix CVE-2024-48073?
No fix has been published for CVE-2024-48073 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-48073 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-48073 exists.
Sources
Also known as GHSA-9vmr-6cpv-xpw5.