« Volver al listado

CVE-2024-26260

Estado: AnalizadaCrítica (9.8)—

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Hgiga — Oaklouds-organization-2.0Hgiga — Oaklouds-organization-3.0Hgiga — Oaklouds-webbase-2.0Hgiga — Oaklouds-webbase-3.0

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-26260",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-26260",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-21T15:11:15.243128Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "Hgiga",
          "modules": [
            "OAKlouds-organization-2.0",
            "OAKlouds-organization-3.0"
          ],
          "product": "OAKlouds",
          "versions": [
            {
              "status": "affected",
              "version": "earlier",
              "lessThan": "188",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Hgiga",
          "modules": [
            "OAKlouds-webbase-2.0",
            "OAKlouds-webbase-3.0"
          ],
          "product": "OAKlouds",
          "versions": [
            {
              "status": "affected",
              "version": "earlier",
              "lessThan": "1051",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hgiga:oaklouds:*:*:*:*:*:*:*:*"
          ],
          "vendor": "hgiga",
          "product": "oaklouds",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "188",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1051",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-02-15T03:15:34.833",
  "references": [
    {
      "url": "https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "twcert@cert.org.tw",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission."
    },
    {
      "lang": "es",
      "value": "La funcionalidad de sincronización en ciertos módulos de HGiga OAKlouds tiene una vulnerabilidad de inyección de comandos del sistema operativo, lo que permite a atacantes remotos inyectar comandos del sistema dentro de parámetros de solicitud específicos. Esto permite la ejecución de código arbitrario en el servidor remoto sin permiso."
    }
  ],
  "lastModified": "2026-06-17T07:17:29.340",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hgiga:oaklouds-organization-2.0:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BDDE14F-3BD2-4AF2-AAFF-BF238F360860",
              "versionEndExcluding": "188"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:oaklouds-organization-3.0:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20A6F111-728D-45DE-B7EC-1C3BC9542F78",
              "versionEndExcluding": "188"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:oaklouds-webbase-2.0:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52C10C8-08A1-4CDC-8309-C3F874EBEFF6",
              "versionEndExcluding": "1051"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:oaklouds-webbase-3.0:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B80523EB-F1BE-4F09-9613-F7CE2F556056",
              "versionEndExcluding": "1051"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}