CVE-2024-8684: OS Command Injection vulnerability in Revolution Pi

Published Feb 10, 2025

Updated

OS Command Injection vulnerability in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. This vulnerability could allow an authenticated attacker to execute OS commands on the device via the ‘php/dal.php’ endpoint, in the ‘arrSaveConfig’ parameter.

Affected Software

1 affected component

Kunbus Revolution Pi

Remediation

Information

The command injection vulnerability has been fixed by the KUNBUS team in the Revolution Pi webstatus 2.4.2 release. Path Traversal vulnerability has been fixed by the KUNBUS team in Revolution Pi pictory 2.1.1.

Event History

Feb 10, 2025

CVE Published

via MITRE·12:45 PM

Data Sourced

via MITRE·12:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-8684?

CVE-2024-8684 is classified as a medium severity OS Command Injection vulnerability.

How do I fix CVE-2024-8684?

To fix CVE-2024-8684, update your KUNBUS Revolution Pi software to the latest version that addresses this vulnerability.

Who is affected by CVE-2024-8684?

CVE-2024-8684 affects users of the Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH.

What type of attack is possible with CVE-2024-8684?

CVE-2024-8684 allows an authenticated attacker to execute arbitrary OS commands on the device.

Which endpoint is vulnerable in CVE-2024-8684?

The vulnerable endpoint in CVE-2024-8684 is 'php/dal.php' with the 'arrSaveConfig' parameter.