Exploitation Summary
CVE-2024-38288 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying server as root.
Nuclei Templates (1)
TurboMeeting - Post-Authentication Command Injection
HIGHVERIFIEDby rootxharsh,iamnoooob,pdresearch
Shodan:
html:"TurboMeeting"
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://github.com/google/security-research/security/advisories/GHSA-gx6g-8mvx-3q5c
Scores
CVSS v3
7.2
EPSS
0.0322
EPSS Percentile
86.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-77
Status
published
Products (1)
rhubcom/turbomeeting
< 8.0
Published
Jul 25, 2024
Tracked Since
Feb 18, 2026