CVE-2024-7440

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of the file upload_file.cgi. The manipulation of the argument QUERY_STRING leads to command injection. It is possible to initiate the attack remotely. The identifier VDB-273525 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
References
Link Resource
https://vuldb.com/?ctiid.273525 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?id.273525 Permissions Required Third Party Advisory VDB Entry
https://vuldb.com/?submit.383839 Third Party Advisory VDB Entry
https://yjz233.notion.site/0213043a8c7e498a9e73a0b6f0fa9f29?pvs=4 Permissions Required
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:vivotek:cc8160_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:vivotek:cc8160:-:*:*:*:*:*:*:*

History

06 Aug 2024, 17:46

Type Values Removed Values Added
CVSS v2 : 6.5
v3 : 6.3
v2 : 6.5
v3 : 9.8
CPE cpe:2.3:o:vivotek:cc8160_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:vivotek:cc8160:-:*:*:*:*:*:*:*
First Time Vivotek cc8160 Firmware
Vivotek
Vivotek cc8160
References () https://vuldb.com/?ctiid.273525 - () https://vuldb.com/?ctiid.273525 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?id.273525 - () https://vuldb.com/?id.273525 - Permissions Required, Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.383839 - () https://vuldb.com/?submit.383839 - Third Party Advisory, VDB Entry
References () https://yjz233.notion.site/0213043a8c7e498a9e73a0b6f0fa9f29?pvs=4 - () https://yjz233.notion.site/0213043a8c7e498a9e73a0b6f0fa9f29?pvs=4 - Permissions Required

05 Aug 2024, 12:41

Type Values Removed Values Added
Summary
  • (es) ** NO SOPORTADO CUANDO SE ASIGNÓ ** Se encontró una vulnerabilidad en Vivotek CC8160 VVTK-0100d. Ha sido clasificada como crítica. Esto afecta la función getenv del archivo upload_file.cgi. La manipulación del argumento QUERY_STRING conduce a la inyección de comando. Es posible iniciar el ataque de forma remota. A esta vulnerabilidad se le asignó el identificador VDB-273525. NOTA: Esta vulnerabilidad solo afecta a productos que ya no son compatibles con el fabricante. NOTA: Se contactó primeramente con el proveedor y se confirmó que el árbol de lanzamiento afectado ha llegado al final de su vida útil.

03 Aug 2024, 17:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-08-03 17:15

Updated : 2024-08-07 21:15


NVD link : CVE-2024-7440

Mitre link : CVE-2024-7440

CVE.ORG link : CVE-2024-7440


JSON object : View

Products Affected

vivotek

  • cc8160
  • cc8160_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')