CVE-2024-43690

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Inclusion of Functionality from Untrusted Control Sphere(CWE-829) in the Command Centre Server and Workstations may allow an attacker to perform Remote Code Execution (RCE).

This issue affects: Command Centre Server and Command Centre Workstations 9.10 prior to vEL9.10.1530 (MR2), 9.00 prior to vEL9.00.2168 (MR4), 8.90 prior to vEL8.90.2155 (MR5), 8.80 prior to vEL8.80.1938 (MR6), all versions of 8.70 and prior.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-436929.8An attacker can directly request the ProGauge MAGLINK LX CONSOLE resource sub page with full privileges by requesting the URL directly.CVE-2024-436939.8A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE UTILITY sub-menu can allow a remote attacker to inject arbitrary comma CVE-2024-436946.5In the goTenna Pro ATAK Plugin application, the encryption keys are stored along with a static IV on the device. This allows for complete CVE-2024-436965.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS by memory leak.CVE-2024-436975.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through improper input.CVE-2024-436989.8Kieback & Peter's DDC4000 series uses weak credentials, which may allow an unauthenticated attacker to get full admin rights on the system.CVE-2024-436999.8Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to e CVE-2024-43705.4The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widg CVE-2024-437007.8xfpt versions prior to 1.01 fails to handle appropriately some parameters inside the input data, resulting in a stack-based buffer overflow CVE-2024-437017.8Software installed and run as a non-privileged user may conduct GPU system calls to read and write freed physical memory from the GPU.CVE-2024-437028.1Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical CVE-2024-437038.1Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physic