CVE-2024-7442: Vivotek SD9364 upload_file.cgi getenv command injection

Published Aug 3, 2024

Updated

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in Vivotek SD9364 VVTK-0103f. It has been rated as critical. This issue affects the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-273527. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.

Affected Software

2 affected components

All of the following

Vivotek SD9364-EH

Vivotek SD9364

Event History

Aug 3, 2024

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-7442?

CVE-2024-7442 is rated as critical due to its potential for command injection via the getenv function.

How does CVE-2024-7442 affect affected devices?

CVE-2024-7442 affects the Vivotek SD9364, specifically through the upload_file.cgi file where the QUERY_STRING parameter can be manipulated.

How do I fix CVE-2024-7442?

To mitigate CVE-2024-7442, it is recommended to update to the latest firmware version provided by Vivotek.

Which devices are affected by CVE-2024-7442?

Specifically, CVE-2024-7442 affects the Vivotek SD9364 firmware versions that are vulnerable.

Is there a way to exploit CVE-2024-7442?

Yes, attackers can exploit CVE-2024-7442 by manipulating the QUERY_STRING argument in web requests to perform command injection.