CVERadar
Edition used by more than 30,000 companies in more than 150 countries.
Sign Up For FreeCVE-2024-7120
Critical Severity|Raisecom
87
SVRS
9.8
CVSSv3
0.934
EPSS
TAGS
In The WildExploit Avaliable
VECTOR STRING
CVSS:3.1AV:NAC:LPR:NUI:NS:UC:HI:HA:H
PUBLICATION DATE2024-07-26
LAST MODIFIED2024-08-01
Deep CVE Analysis in Progress
The system is currently conducting an in-depth analysis of the selected CVE. This includes advanced correlation, vulnerability classification, and cross-referencing with real-time threat intelligence sources. Once the analysis is complete, the page will automatically update with enriched vulnerability data and actionable insights.
Security Intelligence Brief
1. What is this vulnerability and why does it matter?
This is a critical OS command injection vulnerability, identified as CVE-2024-7120. It affects the Web Interface component of several Raisecom MSG series devices. This vulnerability allows an attacker to execute arbitrary operating system commands remotely on the affected device. This matters significantly because successful exploitation can lead to complete compromise of the device, enabling attackers to gain full control, disrupt services, or use the device as a pivot point for further attacks within a network.
2. What are the CVSS score, severity level, and disclosure details?
The CVSS score for this vulnerability is 9.8, classifying it as a Critical severity level. The vulnerability was published on 2024-07-26 05:00:07, and was last modified on 2024-08-01 21:52:30. The exploit has been disclosed to the public and may be actively used.
3. Which products, vendors, systems, and versions are affected?
- Vendor: Raisecom
- Products:
- MSG1200
- MSG2100E
- MSG2200
- MSG2300
- Versions: Specifically, version 3.90 is affected.
4. What is the technical root cause and attack vector?
The technical root cause is an OS command injection flaw (CWE-78: Improper Neutralization of Special Elements used in an OS Command). This occurs due to insufficient input validation or sanitization when processing the 'template' argument within the `list_base_config.php` file in the device's Web Interface component.
The attack vector is remote, meaning an attacker can exploit this vulnerability over a network without needing local access to the device.
The attack vector is remote, meaning an attacker can exploit this vulnerability over a network without needing local access to the device.
5. How can this vulnerability be exploited?
This vulnerability can be exploited by manipulating the 'template' argument in the `list_base_config.php` file, which is part of the affected devices' Web Interface. By injecting malicious operating system commands into this argument, an attacker can cause the device to execute arbitrary commands. Since the attack can be initiated remotely, an attacker only needs network access to the device's web interface.
7. How can vulnerable systems be detected?
Vulnerable systems can be detected by:
- Identifying Raisecom MSG1200, MSG2100E, MSG2200, or MSG2300 devices in the network.
- Verifying if these devices are running version 3.90.
- Monitoring network traffic and web server logs for suspicious requests to `list_base_config.php` that include unusual characters or command sequences in the 'template' parameter.
8. What are the indicators of compromise (IOCs)?
Indicators of Compromise (IOCs) for this vulnerability could include:
- Unauthorized or unexpected outbound network connections from the Raisecom device.
- Unusual process activity or unexpected commands being executed on the device's operating system.
- Modifications to system configurations or files that were not initiated by administrators.
- High CPU or memory utilization without a clear legitimate reason.
- Presence of unfamiliar files or scripts on the device's file system.
- Abnormal log entries indicating failed or successful attempts to execute commands through the web interface.
10. What public intelligence references and advisories exist?
Public intelligence references and advisories include:
- CVE ID: CVE-2024-7120
- VDB-ID: VDB-272451
- The exploit details have been publicly disclosed, indicating that information on how to exploit this vulnerability is available to attackers.
11. What is the risk assessment and urgency level?
The risk level for CVE-2024-7120 is Extremely High, with a CVSS score of 9.8 (Critical). The urgency level is Immediate.
This vulnerability allows for remote OS command injection, which means an attacker can gain full control over affected Raisecom devices without requiring prior authentication or local access. The public disclosure of exploit details further elevates the risk, as it lowers the bar for attackers to weaponize and deploy exploits. Organizations using affected Raisecom MSG series devices (MSG1200, MSG2100E, MSG2200, MSG2300 running version 3.90) should prioritize assessing their exposure and implementing any available mitigations or patches without delay to prevent potential system compromise and unauthorized access.
This vulnerability allows for remote OS command injection, which means an attacker can gain full control over affected Raisecom devices without requiring prior authentication or local access. The public disclosure of exploit details further elevates the risk, as it lowers the bar for attackers to weaponize and deploy exploits. Organizations using affected Raisecom MSG series devices (MSG1200, MSG2100E, MSG2200, MSG2300 running version 3.90) should prioritize assessing their exposure and implementing any available mitigations or patches without delay to prevent potential system compromise and unauthorized access.
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNTCVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.