CVE-2024-58314

HIGH

Atcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-58314 has a selected CVSS score of 8.7 (high); EIP currently links 1 catalogued exploit.

Description

Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'cmd' parameter in web_cgi_main.cgi, enabling remote code execution with administrative credentials.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 12, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

100M IP Phones

Browse ATCOM Technology co., LTD. / 100M IP Phones

Default status: unaffected

CVE List2.7affected

Proofs of concept

1

Catalogued exploits

ExploitDBAtcom 2.7.x.x - Authenticated Command InjectionExploitDB exploitby Mohammed AdelNot analyzed1 file
ExploitDB
PoC details

References

4