CVE-2024-38510

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jul 26, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-385117.2A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user CVE-2024-385127.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform co CVE-2024-385139.8Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue i CVE-2024-385147.4NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of t CVE-2024-385168.8ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in CVE-2024-385177.8Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `inclu CVE-2024-385184.6BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to CVE-2024-385197.8`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the CVE-2024-38527.5GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Fire CVE-2024-385205.3SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it CVE-2024-385216.1Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. T CVE-2024-385226.3Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.h