CVE-2024-48895

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version V1.3.18 and earlier. If this vulnerability is exploited, a remote authenticated attacker may execute an arbitrary OS command.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 20, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-488964.3A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may no CVE-2024-488974.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permiss CVE-2024-488984.3A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they CVE-2024-488994.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses tha CVE-2024-48904.9A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerabi CVE-2024-489004.3A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access CVE-2024-489014.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have pe CVE-2024-489025.4In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via AP CVE-2024-489037.8An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affect CVE-2024-489049.8An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.CVE-2024-489059.1Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.CVE-2024-489066.1Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.