CVE-2024-28027

Estado: ModificadaAlta (7.2)—

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authetnicated OS Command injection that occurs through the attacker-controlled `timer1` parameter, at offset `0x8e80`.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 7.2

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 7.46%
Percentil entre todas las CVEs puntuadas: 94
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1059 Command and Scripting Interpreterexecution90 %

Acceso remoto autenticado (PR:H) a servicio web de router; inyección de comandos OS (CWE-78) en parámetro HTTP permite ejecución arbitraria de comandos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Disable or Remove Feature or Program Vulnerability Scanning Threat Intelligence Program Restrict Web-Based Content Network Segmentation

Tecnologías afectadas (1)

Mc-technologies — MC LR Router Firmware

CWE

CWE-78

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-28027",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28027",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-22T14:16:17.471625Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "MC Technologies",
          "product": "MC LR Router",
          "versions": [
            {
              "status": "affected",
              "version": "2.10.5 (QEMU)"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mc_technologies:mc_lr_router:*:*:*:*:*:*:*:*"
          ],
          "vendor": "mc_technologies",
          "product": "mc_lr_router",
          "versions": [
            {
              "status": "affected",
              "version": "2.10.5qemu"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-21T15:15:28.663",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1953",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1953",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authetnicated OS Command injection that occurs through the attacker-controlled `timer1` parameter, at offset `0x8e80`."
    },
    {
      "lang": "es",
      "value": "Existen tres vulnerabilidades de inyección de comandos del sistema operativo en la funcionalidad de configuración de E/S de la interfaz web del enrutador MC LR 2.10.5 de MC Technologies. Una solicitud HTTP especialmente manipulada puede provocar la ejecución de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para activar estas vulnerabilidades. Esta vulnerabilidad se refiere a la inyección de comandos del sistema operativo autenticados que se produce a través del parámetro `timer1` controlado por el atacante, en el desplazamiento `0x8e80`."
    }
  ],
  "lastModified": "2026-06-17T07:20:50.143",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mc-technologies:mc_lr_router_firmware:2.10.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95D3D1A7-DA67-4319-B836-010FCBE4B63C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mc-technologies:mc_lr_router:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "330D7083-CDC2-4532-8F13-109C8272F5BF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}