CVE-2024-7120

MEDIUM EXPLOITED NUCLEI

Raisecom Msg2300 Firmware - OS Command Injection

Title source: rule

Description

A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. This affects an unknown part of the file list_base_config.php of the component Web Interface. The manipulation of the argument template leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-272451.

Exploits (3)

nomisec WRITEUP 8 stars
by gh-ost00 · remote
https://github.com/gh-ost00/CVE-2024-7120
nomisec WORKING POC 1 stars
by jokeir07x · remote
https://github.com/jokeir07x/CVE-2024-7120-Exploit-by-Dark-07x
inthewild WORKING POC
poc
https://github.com/fa-rrel/cve-2024-7120

Nuclei Templates (1)

Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90 - Command Injection
MEDIUMVERIFIEDby pussycat0x
FOFA: "<TITLE>Web user login</TITLE>" && "<META content\==MSHTML 6.00.2900.5583\" name\=GENERATOR></HEAD>"

References (4)

Scores

CVSS v3 6.3
EPSS 0.9226
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Details

VulnCheck KEV 2024-09-12
CWE
CWE-78
Status published
Products (4)
raisecom/msg1200_firmware 3.90
raisecom/msg2100e_firmware 3.90
raisecom/msg2200_firmware 3.90
raisecom/msg2300_firmware 3.90
Published Jul 26, 2024
Tracked Since Feb 18, 2026