CVE-2024-10195

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Tecno	4G Portable WiFi TR118	V008-20220830

References

https://asciinema.org/a/2mwkmDqRZfeAYTu5hHre1r4QBBroken Link
https://vuldb.com/?ctiid.280969Permissions Required
https://vuldb.com/?id.280969Permissions Required
https://vuldb.com/?submit.422994Third Party Advisory

Timeline

Published: Oct 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-101969.8A vulnerability was found in code-projects Pharmacy Management System 1.0 and classified as critical. This issue affects some unknown proces CVE-2024-101974.8A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. Affected is an unknown fun CVE-2024-101984.8A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been declared as problematic. Affected by this vulnerabili CVE-2024-101994.8A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been rated as problematic. Affected by this issue is some CVE-2024-10206.1A vulnerability classified as problematic was found in Rebuild up to 3.5.5. Affected by this vulnerability is the function getStorageFile of CVE-2024-102007.5Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit th CVE-2024-102018.8Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular priv CVE-2024-102028.8Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privilege CVE-2024-102037.8Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in t CVE-2024-102047.8Heap-based Buffer Overflow and Uninitialized Variable vulnerabilities exist in the X_B and SAT file reading procedure in eDrawings from Rele CVE-2024-102059.4Authentication Bypass vulnerability in Hitachi Ops Center Analyzer on Linux, 64 bit (Hitachi Ops Center Analyzer detail view component), Hit CVE-2024-102066.9A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based a