CVE-2024-58314

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'cmd' parameter in web_cgi_main.cgi, enabling remote code execution with administrative credentials.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Dec 12, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-583157.8Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code CVE-2024-583167.5Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows attackers to inject CVE-2024-583175.3A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration c CVE-2024-583186.1A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the rich text editor compo CVE-2024-583196.1A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard wid CVE-2024-58328.8Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption via a crafte CVE-2024-583205.3An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration interface hostname detai CVE-2024-583215.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form validation rule confi CVE-2024-583225.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping options configurati CVE-2024-583235.4A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form componen CVE-2024-58338.8Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially perform out of bounds memory access vi CVE-2024-583307.5A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytic