CVE-2024-9324

Intelbras InControl Relatório de Operadores Page operador code injection

State: Published
Severity: 5.3 Medium
Published: Sep 29, 2024
Updated: Nov 4, 2024
Reserved: Sep 28, 2024

Description

A vulnerability was found in Intelbras InControl up to 2.21.57. It has been rated as critical. Affected by this issue is some unknown functionality of the file /v1/operador/ of the component Relatório de Operadores Page. The manipulation of the argument fields leads to code injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed early on 2024-07-19 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P	VulDB

Weaknesses

CWE-94 Code Injection
CWE-74 Injection
CWE-707 Improper Neutralization

Affected Products

Product	Versions
InControlIntelbras	2.21.0Affected 2.21.1Affected 2.21.2Affected 2.21.3Affected 2.21.4Affected 2.21.5Affected 2.21.6Affected 2.21.7Affected 2.21.8Affected 2.21.9Affected 2.21.10Affected 2.21.11Affected 2.21.12Affected 2.21.13Affected 2.21.14Affected 2.21.15Affected 2.21.16Affected 2.21.17Affected 2.21.18Affected 2.21.19Affected 2.21.20Affected 2.21.21Affected 2.21.22Affected 2.21.23Affected 2.21.24Affected and 33 more versions

Product

Versions

InControlIntelbras

2.21.0Affected
2.21.1Affected
2.21.2Affected
2.21.3Affected
2.21.4Affected
2.21.5Affected
2.21.6Affected
2.21.7Affected
2.21.8Affected
2.21.9Affected
2.21.10Affected
2.21.11Affected
2.21.12Affected
2.21.13Affected
2.21.14Affected
2.21.15Affected
2.21.16Affected
2.21.17Affected
2.21.18Affected
2.21.19Affected
2.21.20Affected
2.21.21Affected
2.21.22Affected
2.21.23Affected
2.21.24Affected
and 33 more versions

References

VDB-278828 | Intelbras InControl Relatório de Operadores Page operador code injectionvdb-entrytechnical-description
VDB-278828 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #375614 | Intelbras InControl 2.21.57 (last version) Command Injectionthird-party-advisory
https://youtu.be/UdZVktPUy8Amedia-coverage
https://backend.intelbras.com/sites/default/files/2024-10/Aviso%20de%20Seguran%C3%A7a%20-%20Incontrol%202.21.56%20e%202.21.57.pdfrelated
https://download.cronos.intelbras.com.br/download/INCONTROL/INCONTROL-WEB/prod/INCONTROL-WEB-2.21.58-233dfd1ac1e2ca3eabb71c854005c78b.exepatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.