{"id":"CVE-2024-54681","state":"PUBLISHED","title":"Ossur Mobile Logic Application Command Injection","description":"Multiple bash files were present in the application's private directory.\n Bash files can be used on their own, by an attacker that has already \nfull access to the mobile platform to compromise the translations for \nthe application.","publishedAt":"2025-01-17T16:46:40.813Z","updatedAt":"2025-01-21T16:40:59.307Z","severity":{"score":2,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["Ossur Mobile Logic Application"],"affected":[{"vendor":"Ossur","product":"Mobile Logic Application","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.5.5","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01"],"weaknesses":["CWE-77"],"ingestedAt":"2026-10-29T20:08:04.920Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/54xxx/CVE-2024-54681.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-54681","state":"PUBLISHED","datePublished":"2025-01-17T16:46:40.813Z","dateUpdated":"2025-01-21T16:40:59.307Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2024-12-17T14:11:48.995Z"},"containers":{"cna":{"title":"Ossur Mobile Logic Application Command Injection","descriptions":[{"lang":"en","value":"Multiple bash files were present in the application's private directory.\n Bash files can be used on their own, by an attacker that has already \nfull access to the mobile platform to compromise the translations for \nthe application."}],"affected":[{"vendor":"Ossur","product":"Mobile Logic Application","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.5.5","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-354-01"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2,"baseSeverity":"LOW","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-77","description":"CWE-77 Command Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-01-17T16:46:40.813Z"},"credits":[{"lang":"en","type":"finder","value":"Bryan Riggins reported these vulnerabilities to CISA."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Ossur recommends users download Version 1.5.5 or later of the mobile \napplication. The latest version of the application can be obtained \nthrough the app store on respective mobile devices. No additional action\n is required by users.\n\n<br>"}],"value":"Ossur recommends users download Version 1.5.5 or later of the mobile \napplication. The latest version of the application can be obtained \nthrough the app store on respective mobile devices. No additional action\n is required by users."}],"source":{"advisory":"ICSMA-24-354-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-21T16:40:49.310123Z","id":"CVE-2024-54681","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-21T16:40:59.307Z"}}]}}}