CVE-2024-4638
OnCell G3470A-LTE Series: Authenticated Command Injection via webUploadKey
- State
- Published
- Severity
- 7.1 High
- Published
- Jun 25, 2024
- Updated
- Aug 1, 2024
- Reserved
- May 8, 2024
Description
OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in the web key upload function. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N | Moxa |
Weaknesses
- CWE-77 Improper Neutralization of Special Elements used in a Command
Affected Products
| Product | Versions |
|---|---|
OnCell G3470A-LTE SeriesMoxa |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.