CVE-2024-47133

State: Published
Severity: 7.2 High
Published: Dec 5, 2024
Updated: Dec 18, 2024
Reserved: Nov 22, 2024

Description

UD-LT1 firmware Ver.2.1.9 and earlier and UD-LT1/EX firmware Ver.2.1.9 and earlier allow a remote authenticated attacker with an administrative account to execute arbitrary OS commands.

Scores

CVSS	Score	Vector	Source
3.0	7.2 High	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	jpcert

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS Command Injection')

Affected Products

Product	Versions
UD-LT1I-O DATA DEVICE, INC.	firmware Ver.2.1.9 and earlierAffected
UD-LT1/EXI-O DATA DEVICE, INC.	firmware Ver.2.1.9 and earlierAffected

References

https://www.iodata.jp/support/information/2024/11_ud-lt1/
https://jvn.jp/en/jp/JVN46615026/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.