CVE-2024-7469

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been declared as critical. This vulnerability affects the function sslvpn_config_mod of the file /vpn/list_vpn_web_custom.php of the component Web Interface. The manipulation of the argument template/stylenum leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-273562 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-74709.8A vulnerability was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. It has been rated as critical. This issue affects the fun CVE-2024-74726.5lunary-ai/lunary v1.2.26 contains an email injection vulnerability in the Send email verification API (/v1/users/send-verification) and Sign CVE-2024-74736.5An IDOR vulnerability exists in the 'Evaluations' function of the 'umgws datasets' section in lunary-ai/lunary versions 1.3.2. This vulnerab CVE-2024-74748.1In version 1.3.2 of lunary-ai/lunary, an Insecure Direct Object Reference (IDOR) vulnerability exists. A user can view or delete external us CVE-2024-74759.1An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without autho CVE-2024-74764.3A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated att CVE-2024-74776.7A SQL injection vulnerability was found which could allow a command line interface (CLI) user with administrative privileges to execute arbi CVE-2024-74785.8When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence or validity of usernam CVE-2024-74798.8Improper verification of cryptographic signature during installation of a VPN driver via the TeamViewer_service.exe component of TeamViewer CVE-2024-74804.4An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with a CVE-2024-74818.8Improper verification of cryptographic signature during installation of a Printer driver via the TeamViewer_service.exe component of TeamVie CVE-2024-74847.2The CRM Perks Forms plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation on the 'handle_uploaded