CVE-2024-41889
CRITICALPimax Products - RCE
Title source: llmDescription
Multiple Pimax products accept WebSocket connections from unintended endpoints. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker.
Scores
CVSS v3
9.8
EPSS
0.0133
EPSS Percentile
79.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Classification
CWE
CWE-923
Status
published
Affected Products (2)
pimax/pitool
pimax/play
< 1.21.01
Timeline
Published
Aug 05, 2024
Tracked Since
Feb 18, 2026