CVE-2024-24386

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-24386
An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.

7.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://erickduarte.notion.site/VitalPBX-3-2-4-5-ee402173241c493687aa22ec60160c67?pvs=4 Exploit Third Party Advisory
https://github.com/erick-duarte/CVE-2024-24386 Exploit Third Party Advisory
https://erickduarte.notion.site/VitalPBX-3-2-4-5-ee402173241c493687aa22ec60160c67?pvs=4 Exploit Third Party Advisory
https://github.com/erick-duarte/CVE-2024-24386 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:vitalpbx:vitalpbx:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.4-2:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.4-4:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.6-1:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.6-2:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.8:-:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.8:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.8:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.9:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.9:r5:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.1:-:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.1:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.1:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.2:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.3:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.4:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.4:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r4:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.6:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.7:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.2:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r4:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r5:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r6:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r7:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r8:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r9:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r4:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r5:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r6:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.5:r1:*:*:*:*:*:*
History

18 Sep 2025, 16:22

Type Values Removed Values Added
References () https://erickduarte.notion.site/VitalPBX-3-2-4-5-ee402173241c493687aa22ec60160c67?pvs=4 - () https://erickduarte.notion.site/VitalPBX-3-2-4-5-ee402173241c493687aa22ec60160c67?pvs=4 - Exploit, Third Party Advisory
References () https://github.com/erick-duarte/CVE-2024-24386 - () https://github.com/erick-duarte/CVE-2024-24386 - Exploit, Third Party Advisory
First Time Vitalpbx vitalpbx
Vitalpbx
CPE cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r7:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.8:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r8:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.8:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r6:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.4-2:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.4:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r4:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.4-4:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.3:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.6-1:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.1:-:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r4:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.7:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r4:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.2:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r6:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r5:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.1:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.6:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.5:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.4:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.5:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.9:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.1:r3:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r5:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.6-2:*:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.8:-:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.9:r5:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.1.2:r1:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.4:r2:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.2.3:r9:*:*:*:*:*:*
cpe:2.3:a:vitalpbx:vitalpbx:3.0.4:*:*:*:*:*:*:*

21 Nov 2024, 08:59

Type Values Removed Values Added
References () https://erickduarte.notion.site/VitalPBX-3-2-4-5-ee402173241c493687aa22ec60160c67?pvs=4 - () https://erickduarte.notion.site/VitalPBX-3-2-4-5-ee402173241c493687aa22ec60160c67?pvs=4 -
References () https://github.com/erick-duarte/CVE-2024-24386 - () https://github.com/erick-duarte/CVE-2024-24386 -

19 Aug 2024, 21:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.2
Summary
  • (es) Un problema en VitalPBX v.3.2.4-5 permite a un atacante ejecutar código arbitrario a través de un payload manipulado en la carpeta /var/lib/vitalpbx/scripts.
CWE CWE-284

15 Feb 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-15 08:15

Updated : 2025-09-18 16:22

NVD link : CVE-2024-24386

Mitre link : CVE-2024-24386

CVE.ORG link : CVE-2024-24386

JSON object : View

Products Affected

vitalpbx

  • vitalpbx
CWE
CWE-284

Improper Access Control