CVE-2024-22366: OS Command Injection

Published Jan 24, 2024
·
Updated

Active debug code exists in Yamaha wireless LAN access point devices. If a logged-in user who knows how to use the debug function accesses the device's management page, this function can be enabled by performing specific operations. As a result, an arbitrary OS command may be executed and/or configuration settings of the device may be altered. Affected products and versions are as follows: WLX222 firmware Rev.24.00.03 and earlier, WLX413 firmware Rev.22.00.05 and earlier, WLX212 firmware Rev.21.00.12 and earlier, WLX313 firmware Rev.18.00.12 and earlier, and WLX202 firmware Rev.16.00.18 and earlier.

Affected Software

10 affected components
All of the following
Yamaha WLX222 firmware<24.00.04
Yamaha WLX222
All of the following
Yamaha WLX413 firmware<22.00.06
Yamaha WLX413
All of the following
Yamaha WLX212 firmware<21.00.13
Yamaha WLX212
All of the following
Yamaha WLX313 firmware<18.00.13
Yamaha WLX313
All of the following
Yamaha WLX202 firmware<16.00.19
Yamaha WLX202

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Yamaha WLX222 to a version that resolves this vulnerability.

    Fixed in Rev.24.00.03
  2. Upgrade

    Upgrade Yamaha WLX413 to a version that resolves this vulnerability.

    Fixed in Rev.22.00.05
  3. Upgrade

    Upgrade Yamaha WLX212 to a version that resolves this vulnerability.

    Fixed in Rev.21.00.12
  4. Upgrade

    Upgrade Yamaha WLX313 to a version that resolves this vulnerability.

    Fixed in Rev.18.00.12
  5. Upgrade

    Upgrade Yamaha WLX202 to a version that resolves this vulnerability.

    Fixed in Rev.16.00.18

Event History

Jan 24, 2024
CVE Published
via MITRE·04:35 AM
Data Sourced
via MITRE·04:35 AM
DescriptionWeakness
Data Sourced
via NVD·05:15 AM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-22366?

CVE-2024-22366 is a high severity vulnerability due to the potential for arbitrary OS command execution.

2

How do I fix CVE-2024-22366?

To fix CVE-2024-22366, ensure that your Yamaha wireless LAN access point firmware is updated to the latest version available.

3

Which devices are affected by CVE-2024-22366?

CVE-2024-22366 affects certain Yamaha wireless LAN access point devices including WLX222, WLX413, WLX212, WLX313, and WLX202.

4

What kind of attack can be executed through CVE-2024-22366?

An attacker with access to the device's management page can execute arbitrary OS commands through the active debug code.

5

Is it necessary to disable the debug function to protect against CVE-2024-22366?

Yes, disabling the debug function is a recommended step to mitigate the risk associated with CVE-2024-22366.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203