« Volver al listado

CVE-2024-50625

Estado: AnalizadaAlta (8)—

An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:A/PR:L: acceso de red adyacente con privilegios locales. Carga de archivos arbitrarios en directorios específicos (CWE-434) sugiere web shell. Escalada de privilegios explícita en la descripción como impacto potencial.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramDisable or Remove Feature or ProgramApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (1)

Digi — Connectport LTS Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-50625",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-50625",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-11T20:39:52.466020Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-09T22:15:22.610",
  "references": [
    {
      "url": "https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.digi.com/resources/security",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Digi ConnectPort LTS anterior a la versión 1.4.12. Una vulnerabilidad en el manejo de carga de archivos de una aplicación web permite la manipulación de rutas de archivos mediante solicitudes POST. Esto puede provocar cargas de archivos arbitrarias dentro de directorios específicos, lo que potencialmente permite la escalada de privilegios cuando se combina con otras vulnerabilidades."
    }
  ],
  "lastModified": "2026-06-17T08:04:50.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:digi:connectport_lts_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "36E2B8EB-FD51-4EFD-87BC-61841B5B1372",
              "versionEndExcluding": "1.4.12"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:digi:connectport_lts_16:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D927F6A5-D6AA-4AEB-A7E8-CA5A3BE5ED6E"
            },
            {
              "criteria": "cpe:2.3:h:digi:connectport_lts_16_mei:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BDCB83B5-1662-47D8-89E9-F64297D235A5"
            },
            {
              "criteria": "cpe:2.3:h:digi:connectport_lts_16_mei_2ac:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CCF5F04A-5AE9-4C1B-8F54-820CF6673E12"
            },
            {
              "criteria": "cpe:2.3:h:digi:connectport_lts_32:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6F118AD7-F6E3-4F5F-91F6-B52978C0018D"
            },
            {
              "criteria": "cpe:2.3:h:digi:connectport_lts_32_mei:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E4D38E1C-90DE-4B19-9CE4-3B9116AE7AE0"
            },
            {
              "criteria": "cpe:2.3:h:digi:connectport_lts_8_mei:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "78489691-DF52-45FF-BC61-7DDBCB0B56F0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}