Exploitation Summary
EIP tracks 2 public exploits for CVE-2024-48841. PoCs published by LiquidWorm.
AI-analyzed exploit summary This exploit demonstrates an authenticated remote code execution vulnerability in ABB Cylon FLXeon controllers via command injection in the /api/users/password endpoint. The newPassword parameter is improperly escaped before being passed to ChildProcess.exec() within a usermod command, allowing arbitrary command execution.
Description
Network access can be used to execute arbitrary code with elevated privileges. This issue affects FLXEON 9.3.4 and older.
Exploits (2)
This exploit demonstrates an authenticated remote code execution vulnerability in ABB Cylon FLXeon controllers via command injection in the /api/users/password endpoint. The newPassword parameter is improperly escaped before being passed to ChildProcess.exec() within a usermod command, allowing arbitrary command execution.
This exploit demonstrates authenticated remote code execution (RCE) in ABB Cylon FLXeon BACnet controllers via command injection in the /api/timeConfig endpoint. The PoC uses curl to send maliciously crafted JSON payloads with backtick-enclosed commands in multiple fields, exploiting improper input validation in timeConfig.js.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H