CVE-2024-7443: Vivotek IB8367A upload_file.cgi getenv command injection

Published Aug 3, 2024

Updated

UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in Vivotek IB8367A VVTK-0100b. Affected is the function getenv of the file uploadfile.cgi. The manipulation of the argument QUERYSTRING leads to command injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-273528. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.

Affected Software

2 affected components

All of the following

Vivotek Ib8367a Firmware

Vivotek IB8367A

Event History

Aug 3, 2024

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-7443?

CVE-2024-7443 is classified as a critical vulnerability.

How do I fix CVE-2024-7443?

To mitigate CVE-2024-7443, it is recommended to apply any available security updates from Vivotek for the IB8367A firmware.

What type of vulnerability is CVE-2024-7443?

CVE-2024-7443 is a command injection vulnerability caused by improper handling of the QUERY_STRING argument.

Which devices are affected by CVE-2024-7443?

CVE-2024-7443 affects the Vivotek IB8367A when using certain firmware versions.

What is the impact of CVE-2024-7443?

The impact of CVE-2024-7443 includes the potential for an attacker to execute arbitrary commands on the affected device.