CVE-2024-23961

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the UPDM_wemCmdUpdFSpeDecomp function. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Was ZDI-CAN-23306

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 28, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-239625.3This vulnerability allows remote attackers to disclose sensitive information on affected installations of Alpine Halo9 devices. Authenticati CVE-2024-239638.0This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacke CVE-2024-239678.0Autel MaxiCharger AC Elite Business C50 WebSocket Base64 Decoding Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vuln CVE-2024-239688.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239698.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-23976.2Due to a bug in packet data buffers management, the PPP printer in tcpdump can enter an infinite loop when reading a crafted DLT_PPP_SERIAL CVE-2024-239706.5This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex cha CVE-2024-239718.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239726.8Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically prese CVE-2024-239738.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentic CVE-2024-239746.7Incorrect default permissions in some Intel(R) ISH software installers may allow an authenticated user to potentially enable escalation of p CVE-2024-239758.8SQL injection vulnerability exists in GetDIAE_slogListParameters.