{"id":"CVE-2024-8684","state":"PUBLISHED","title":"OS Command Injection vulnerability in Revolution Pi","description":"OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter.","publishedAt":"2025-02-10T12:45:35.339Z","updatedAt":"2025-02-12T15:43:30.941Z","severity":{"score":8.3,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","source":"INCIBE"},"assigner":"INCIBE","products":["KUNBUS GmbH Revolution Pi"],"affected":[{"vendor":"KUNBUS GmbH","product":"Revolution Pi","defaultStatus":"unaffected","versions":[{"version":"2022-07-28-revpi-buster version","status":"affected"}]}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-kunbus-gmbhs-revolution-pi"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8684.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8684","state":"PUBLISHED","datePublished":"2025-02-10T12:45:35.339Z","dateUpdated":"2025-02-12T15:43:30.941Z","assignerShortName":"INCIBE","assignerOrgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateReserved":"2024-09-11T08:12:14.979Z"},"containers":{"cna":{"title":"OS Command Injection vulnerability in Revolution Pi","descriptions":[{"lang":"en","value":"OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter."}],"affected":[{"vendor":"KUNBUS GmbH","product":"Revolution Pi","defaultStatus":"unaffected","versions":[{"version":"2022-07-28-revpi-buster version","status":"affected"}]}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-kunbus-gmbhs-revolution-pi"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.3,"baseSeverity":"HIGH","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"INCIBE","orgId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","dateUpdated":"2025-02-10T12:45:35.339Z"},"credits":[{"lang":"en","type":"finder","value":"Ethan Shackelford"}],"datePublic":"2025-02-10T11:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The command injection vulnerability has been fixed by the KUNBUS team in the Revolution Pi webstatus 2.4.2 release. Path Traversal vulnerability has been fixed by the KUNBUS team in Revolution Pi pictory 2.1.1."}],"value":"The command injection vulnerability has been fixed by the KUNBUS team in the Revolution Pi webstatus 2.4.2 release. Path Traversal vulnerability has been fixed by the KUNBUS team in Revolution Pi pictory 2.1.1."}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-02-10T13:22:11.180211Z","id":"CVE-2024-8684","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-12T15:43:30.941Z"}}]}}}