CVE-2024-48419

Published Jan 27, 2025

Last updated a year ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2024-48419 describes command injection vulnerabilities found in the Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC, specifically version 1.06. These issues reside within the `/bin/goahead` component of the router's firmware. An attacker with access to the web interface can exploit these vulnerabilities by injecting and executing arbitrary shell commands with root privileges. This can be achieved through specific diagnostic functions, including `/goform/tracerouteDiagnosis`, `/goform/pingDiagnosis`, and `/goform/fromSysToolPingCmd`.

Description: Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06 suffers from Command Injection issues in /bin/goahead. Specifically, these issues can be triggered through /goform/tracerouteDiagnosis, /goform/pingDiagnosis, and /goform/fromSysToolPingCmd Each of these issues allows an attacker with access to the web interface to inject and execute arbitrary shell commands, with "root" privileges.
Source: cve@mitre.org
NVD status: Analyzed
Products: br-6476ac_firmware

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-77

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 8

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:edimax:br-6476ac_firmware:1.06:*:*:*:*:*:*:*",
            "matchCriteriaId": "01D4A5C7-91C8-4AD9-9A04-A1F32BA34DAA",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:edimax:br-6476ac:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "89161819-C549-457C-971F-2793AC9D6F94",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.