CVE-2024-56838

HighCVSS 7.2/10Last modified Oct 24, 2026

Description

A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGEDCOM ROX RX1400 (All versions < V2.17.0), RUGGEDCOM ROX RX1500 (All versions < V2.17.0), RUGGEDCOM ROX RX1501 (All versions < V2.17.0), RUGGEDCOM ROX RX1510 (All versions < V2.17.0), RUGGEDCOM ROX RX1511 (All versions < V2.17.0), RUGGEDCOM ROX RX1512 (All versions < V2.17.0), RUGGEDCOM ROX RX1524 (All versions < V2.17.0), RUGGEDCOM ROX RX1536 (All versions < V2.17.0), RUGGEDCOM ROX RX5000 (All versions < V2.17.0). The SCEP client available in the affected device for secure certificate enrollment lacks validation of multiple fields. An attacker could leverage this scenario to execute arbitrary code as root user.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2025
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-568397.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGE CVE-2024-56848.8An attacker with access to the private network (the charger is connected to) or local access to the Ethernet-Interface can exploit a faulty CVE-2024-568407.2A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.0), RUGGEDCOM ROX MX5000RE (All versions < V2.17.0), RUGGE CVE-2024-568417.4A vulnerability has been identified in Mendix LDAP (All versions < V1.1.2). Affected versions of the module are vulnerable to LDAP injection CVE-2024-56858.1Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's membe CVE-2024-56865.4The WPZOOM Addons for Elementor (Templates, Widgets) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribu CVE-2024-56875.3If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been in CVE-2024-56888.1If a garbage collection was triggered at the right time, a use-after-free could have occurred during object transplant. This vulnerability a CVE-2024-568825.4Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role privileges can permane CVE-2024-568838.1Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are not always enforced on CVE-2024-568897.5Incorrect access control in the endpoint /admin/m_delete.php of CodeAstro Complaint Management System v1.0 allows unauthorized attackers to CVE-2024-56894.3In addition to detecting when a user was taking a screenshot (XXX), a website was able to overlay the 'My Shots' button that appeared, and d