CVE-2024-41889

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-923

Affected software

Vendor	Product	Versions
Pimax	Pimax Play	prior to V1.21.01
Pimax	PiTool	all versions
pimax	pitool	< *
pimax	play	< 1.21.01

References

https://github.com/OpenMAR/PiToolProduct
https://jvn.jp/en/jp/JVN50850706/Third Party Advisory
https://pimax.com/pages/downloads-manualsProduct

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-41898.0Improper Restriction of XML External Entity Reference vulnerability in OpenText Application Automation Tools allows DTD Injection.This issue CVE-2024-418905.3Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User CVE-2024-41908.1Stored Cross-Site Scripting (XSS) vulnerabilities have been identified in OpenText ArcSight Logger. The vulnerabilities could be remotely ex CVE-2024-419027.8A vulnerability has been identified in JT2Go (All versions < V2406.0003). The affected application contains a stack-based buffer overflow vu CVE-2024-419037.2A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application mounts th CVE-2024-419047.5A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not pr CVE-2024-419056.5A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not ha CVE-2024-419066.5A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application does not CVE-2024-419075.4A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application is missin CVE-2024-419087.8A vulnerability has been identified in NX (All versions < V2406.3000). The affected applications contains an out of bounds read vulnerabilit CVE-2024-419095.9Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that CVE-2024-419106.1A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware contained multiple XSS