« Volver al listado

CVE-2024-28026

Estado: ModificadaAlta (7.2)—

Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authenticated OS Command Injection that occurs through the attacker-controlled `out1` parameter, at offset `0x8efc`.

Detalles técnicos trazas, registros y código del informe original
    int out_ret = sscanf(current_param->key, "out%u", &io_idx);
    if (out_ret == 1 && io_idx == 1)
    {
        // [4] Similar to `3`, but `out1` instead of `btn1`
        if (asprintf(&command, "/usr/sbin/vout %s %u vo_manual", current_param->value, 1) > 0)
        {
            system(command);
            return -1;
        }
    }

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inyección de comandos OS en interfaz web autenticada (PR:H) de router remoto. El parámetro 'out1' se ejecuta sin sanitizar mediante system(), permitiendo ejecución arbitraria de comandos tras autenticación en red.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentNetwork Segmentation

Tecnologías afectadas (1)

Mc-technologies — MC LR Router Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-28026",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-28026",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-11-22T14:21:55.406688Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "talos-cna@cisco.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "talos-cna@cisco.com",
      "affectedData": [
        {
          "vendor": "MC Technologies",
          "product": "MC LR Router",
          "versions": [
            {
              "status": "affected",
              "version": "2.10.5 (QEMU)"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mc_technologies:mc_lr_router:*:*:*:*:*:*:*:*"
          ],
          "vendor": "mc_technologies",
          "product": "mc_lr_router",
          "versions": [
            {
              "status": "affected",
              "version": "2.10.5qemu"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-11-21T15:15:28.323",
  "references": [
    {
      "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1953",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "talos-cna@cisco.com"
    },
    {
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1953",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "talos-cna@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Three OS command injection vulnerabilities exist in the web interface I/O configuration functionality of MC Technologies MC LR Router 2.10.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability refers to the authenticated OS Command Injection that occurs through the attacker-controlled `out1` parameter, at offset `0x8efc`.\r\n\r\n    \r\n    int out_ret = sscanf(current_param->key, \"out%u\", &io_idx);\r\n    if (out_ret == 1 && io_idx == 1)\r\n    {\r\n        // [4] Similar to `3`, but `out1` instead of `btn1`\r\n        if (asprintf(&command, \"/usr/sbin/vout %s %u vo_manual\", current_param->value, 1) > 0)\r\n        {\r\n            system(command);\r\n            return -1;\r\n        }\r\n    }"
    },
    {
      "lang": "es",
      "value": "Existen tres vulnerabilidades de inyección de comandos del sistema operativo en la funcionalidad de configuración de E/S de la interfaz web del enrutador MC LR 2.10.5 de MC Technologies. Una solicitud HTTP especialmente manipulada puede provocar la ejecución de comandos arbitrarios. Un atacante puede realizar una solicitud HTTP autenticada para activar estas vulnerabilidades. Esta vulnerabilidad se refiere a la inyección de comandos del sistema operativo autenticada que se produce a través del parámetro `out1` controlado por el atacante, en el desplazamiento `0x8efc`. int out_ret = sscanf(current_param->key, \"out%u\", &io_idx); if (out_ret == 1 && io_idx == 1) { // [4] Similar a `3`, pero `out1` en lugar de `btn1` if (asprintf(&command, \"/usr/sbin/vout %s %u vo_manual\", current_param->value, 1) > 0) { system(command); return -1; } }"
    }
  ],
  "lastModified": "2026-06-17T07:20:50.030",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:mc-technologies:mc_lr_router_firmware:2.10.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95D3D1A7-DA67-4319-B836-010FCBE4B63C"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:mc-technologies:mc_lr_router:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "330D7083-CDC2-4532-8F13-109C8272F5BF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "talos-cna@cisco.com"
}