CVE-2024-37023

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Multiple OS command injection vulnerabilities affecting Vonets

industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint parameters.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
VonetsVAR1200-H<= 3.3.23.6.9
VonetsVAR1200-L<= 3.3.23.6.9
VonetsVAR600-H<= 3.3.23.6.9
VonetsVAP11AC<= 3.3.23.6.9
VonetsVAP11G-500S<= 3.3.23.6.9
VonetsVBG1200<= 3.3.23.6.9
VonetsVAP11S-5G<= 3.3.23.6.9
VonetsVAP11S<= 3.3.23.6.9
VonetsVAR11N-300<= 3.3.23.6.9
VonetsVAP11G-300<= 3.3.23.6.9
VonetsVAP11N-300<= 3.3.23.6.9
VonetsVAP11G<= 3.3.23.6.9
VonetsVAP11G-500<= 3.3.23.6.9
VonetsVBG1200<= 3.3.23.6.9
VonetsVAP11AC<= 3.3.23.6.9
VonetsVGA-1000<= 3.3.23.6.9
vonetsvar1200-h_firmware<= 3.3.23.6.9
vonetsvar1200-l_firmware<= 3.3.23.6.9
vonetsvar600-h_firmware<= 3.3.23.6.9
vonetsvap11ac_firmware<= 3.3.23.6.9
vonetsvap11g-500s_firmware<= 3.3.23.6.9
vonetsvbg1200_firmware<= 3.3.23.6.9
vonetsvap11s-5g_firmware<= 3.3.23.6.9
vonetsvap11s_firmware<= 3.3.23.6.9
vonetsvar11n-300_firmware<= 3.3.23.6.9
vonetsvap11n-300_firmware<= 3.3.23.6.9
vonetsvap11g_firmware<= 3.3.23.6.9
vonetsvga-1000_firmware<= 3.3.23.6.9
vonetsvap11g-300_firmware<= 3.3.23.6.9
vonetsvap11n-300_firmware<= 3.3.23.6.9

References

Timeline

Published
Aug 12, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-370246.7Uncontrolled search path for some ACAT software maintained by Intel(R) for Windows before version 3.11.0 may allow an authenticated user to CVE-2024-370256.7Incorrect execution-assigned permissions in some Intel(R) Advanced Link Analyzer Standard Edition software installer before version 23.1.1 mCVE-2024-370265.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Only use reserved BCS instances for usm migrate exec queue TheCVE-2024-370276.1Improper Input validation in some Intel(R) VTune(TM) Profiler software before version 2024.2.0 may allow an authenticated user to potentiallCVE-2024-370285.3BIG-IP Next Central Manager may allow an attacker to lock out an account that has never been logged in.  Note: Software versions which have CVE-2024-370297.8Fuji Electric Tellus Lite V-Simulator is vulnerable to a stack-based buffer overflow, which could allow an attacker to execute arbitrary coCVE-2024-37034.7The Carousel Slider WordPress plugin before 2.2.10 does not validate and escape some of its Slide options before outputting them back in theCVE-2024-370309.8in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbitrary code execution in pre-installed apps through use after free.CVE-2024-370316.1The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create eCVE-2024-370328.8Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandlesCVE-2024-370345.9An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with theCVE-2024-370369.8CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa