CVE-2024-37023

Summary

Multiple OS command injection vulnerabilities affecting Vonets

industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters.

Affected Software

VendorProductVersion RangeStatus
VonetsVAR1200-H0 <= 3.3.23.6.9affected
VonetsVAR1200-L0 <= 3.3.23.6.9affected
VonetsVAR600-H0 <= 3.3.23.6.9affected
VonetsVAP11AC0 <= 3.3.23.6.9affected
VonetsVAP11G-500S0 <= 3.3.23.6.9affected
VonetsVBG12000 <= 3.3.23.6.9affected
VonetsVAP11S-5G0 <= 3.3.23.6.9affected
VonetsVAP11S0 <= 3.3.23.6.9affected
VonetsVAR11N-3000 <= 3.3.23.6.9affected
VonetsVAP11G-3000 <= 3.3.23.6.9affected
VonetsVAP11N-3000 <= 3.3.23.6.9affected
VonetsVAP11G0 <= 3.3.23.6.9affected
VonetsVAP11G-5000 <= 3.3.23.6.9affected
VonetsVBG12000 <= 3.3.23.6.9affected
VonetsVAP11AC0 <= 3.3.23.6.9affected
VonetsVGA-10000 <= 3.3.23.6.9affected

Weaknesses

  • CWE-77: CWE-77 Command Injection

Workarounds

Vonets has not responded to requests to work with CISA to mitigate these vulnerabilities. Users of the affected products are encouraged to contact Vonets support https://usdhs-my.sharepoint.com/personal/grayson_gaylor_associates_cisa_dhs_gov1/_layouts/15/support@vonets.com for additional information.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References