CVE-2024-7440: Vivotek CC8160 upload_file.cgi getenv command injection

Published Aug 3, 2024

Updated

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Vivotek CC8160 VVTK-0100d. It has been classified as critical. This affects the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. It is possible to initiate the attack remotely. The identifier VDB-273525 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.

Affected Software

2 affected components

All of the following

Vivotek Cc8160 Firmware

Vivotek CC8160

Event History

Aug 3, 2024

CVE Published

via MITRE·04:31 PM

Data Sourced

via MITRE·04:31 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-7440?

CVE-2024-7440 is classified as a critical vulnerability.

How does CVE-2024-7440 occur?

CVE-2024-7440 occurs due to command injection in the getenv function of the file upload_file.cgi via manipulated QUERY_STRING arguments.

What software is affected by CVE-2024-7440?

CVE-2024-7440 affects the Vivotek CC8160 firmware.

How can I mitigate CVE-2024-7440?

To mitigate CVE-2024-7440, ensure that the affected software is updated to the latest secure version.

Is there a workaround for CVE-2024-7440?

Currently, there are no publicly documented workarounds for CVE-2024-7440.