CVE-2024-1254

MEDIUM

Byzoro Smart S20 Firmware < 2023-11-20 - SQL Injection

Title source: rule
STIX 2.1

Description

A vulnerability, which was classified as critical, was found in Byzoro Smart S20 Management Platform up to 20231120. This affects an unknown part of the file /sysmanage/sysmanageajax.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252993 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4
Core References
Permissions Required, Third Party Advisory vdb-entry technical-description
https://vuldb.com/?id.252993
Permissions Required, Third Party Advisory signature permissions-required
https://vuldb.com/?ctiid.252993
Permissions Required, VDB Entry third-party-advisory
https://vuldb.com/?submit.274042

Scores

CVSS v3 4.7
EPSS 0.0002
EPSS Percentile 4.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-89
Status published
Products (1)
byzoro/smart_s20_firmware < 2023-11-20
Published Feb 06, 2024
Tracked Since Feb 18, 2026