CVE-2024-31408
- State
- Published
- Severity
- 8.0 High
- Published
- Nov 22, 2024
- Updated
- Dec 5, 2024
- Reserved
- Sep 26, 2024
Description
OS command injection vulnerability exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent authenticated attacker may execute an arbitrary OS command with root privileges by sending a specially crafted request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 8.0 High | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | jpcert |
Weaknesses
- CWE-78 Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
IX-MVAIPHONE CO., LTD. |
|
IX-MV7-HBAIPHONE CO., LTD. |
|
IX-MV7-HBTAIPHONE CO., LTD. |
|
IX-MV7-HWAIPHONE CO., LTD. |
|
IX-MV7-HWTAIPHONE CO., LTD. |
|
IX-MV7-HW-JPAIPHONE CO., LTD. |
|
IX-MV7-BAIPHONE CO., LTD. |
|
IX-MV7-BTAIPHONE CO., LTD. |
|
IX-MV7-WAIPHONE CO., LTD. |
|
IX-MV7-WTAIPHONE CO., LTD. |
|
IX-DAAIPHONE CO., LTD. |
|
IX-DAUAIPHONE CO., LTD. |
|
IX-DBAIPHONE CO., LTD. |
|
IX-DBTAIPHONE CO., LTD. |
|
IX-EAAIPHONE CO., LTD. |
|
IX-EATAIPHONE CO., LTD. |
|
IX-EAUAIPHONE CO., LTD. |
|
IX-DVAIPHONE CO., LTD. |
|
IX-DVTAIPHONE CO., LTD. |
|
IX-DVFAIPHONE CO., LTD. |
|
IX-DVF-PAIPHONE CO., LTD. |
|
IX-DVF-LAIPHONE CO., LTD. |
|
IX-DVMAIPHONE CO., LTD. |
|
IX-DUAIPHONE CO., LTD. |
|
IX-DVF-RAAIPHONE CO., LTD. |
|
IX-DVF-2RAAIPHONE CO., LTD. |
|
IX-BAAIPHONE CO., LTD. |
|
IX-BAUAIPHONE CO., LTD. |
|
IX-BBAIPHONE CO., LTD. |
|
IX-BBTAIPHONE CO., LTD. |
|
IX-FAAIPHONE CO., LTD. |
|
IX-SSAAIPHONE CO., LTD. |
|
IX-SS-2GAIPHONE CO., LTD. |
|
IX-SS-2GTAIPHONE CO., LTD. |
|
IX-SS-2G-NAIPHONE CO., LTD. |
|
IX-BUAIPHONE CO., LTD. |
|
IX-SSA-RAAIPHONE CO., LTD. |
|
IX-SSA-2RAAIPHONE CO., LTD. |
|
IX-RS-BAIPHONE CO., LTD. |
|
IX-RS-BTAIPHONE CO., LTD. |
|
IX-RS-WAIPHONE CO., LTD. |
|
IX-RS-WTAIPHONE CO., LTD. |
|
IXW-MAAIPHONE CO., LTD. |
|
IX-SPMICAIPHONE CO., LTD. |
|
IXG-2C7AIPHONE CO., LTD. |
|
IXG-2C7-LAIPHONE CO., LTD. |
|
IXG-DM7AIPHONE CO., LTD. |
|
IXG-DM7-HIDAIPHONE CO., LTD. |
|
IXG-DM7-HIDAAIPHONE CO., LTD. |
|
IXG-DM7-10KAIPHONE CO., LTD. |
|
IXG-MKAIPHONE CO., LTD. |
|
IXGW-GWAIPHONE CO., LTD. |
|
IXGW-TGWAIPHONE CO., LTD. |
|
IXGW-LCAIPHONE CO., LTD. |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.