CVE-2024-41925

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)

Published: Oct 3, 2024 / Updated: 47d ago

010
CVSS 9.3EPSS 0.04%Critical
CVE info copied to clipboard

Summary

The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.

Impact

This vulnerability has a critical severity with a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.3. The impact is severe across all three main security aspects: 1. Confidentiality: High impact, potentially allowing unauthorized access to sensitive information. 2. Integrity: High impact, possibly enabling attackers to modify or manipulate data. 3. Availability: High impact, potentially causing disruption of service or system availability. Attacks exploiting this vulnerability could lead to: - Unauthorized access to the system - Execution of arbitrary code on the affected device - Complete compromise of the ONS-S8 - Spectra Aggregation Switch - Potential lateral movement within the network - Data theft or manipulation - Service disruptions The vulnerability requires no user interaction and can be exploited remotely over the network, making it particularly dangerous.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the provided information, there is no explicit mention of an available patch. However, given the critical nature of the vulnerability, it is highly recommended to check with the vendor (Elektrobit) for any available security updates or patches for the ONS-S8 - Spectra Aggregation Switch.

Mitigation

While waiting for a patch, consider the following mitigation strategies: 1. Network Segmentation: Isolate the affected ONS-S8 - Spectra Aggregation Switches in a separate network segment with restricted access. 2. Access Control: Implement strict access controls to limit who can interact with the web service of the affected devices. 3. Web Application Firewall (WAF): Deploy a WAF to filter and monitor HTTP traffic between the web application and the Internet. 4. Input Validation: If possible, implement additional input validation mechanisms at the network level to filter out potentially malicious requests. 5. Monitoring: Enhance monitoring of the affected systems for any suspicious activities or unauthorized access attempts. 6. Disable unnecessary services: If the web service is not critical for operations, consider disabling it until a patch is available. 7. Regular updates: Keep the system and all associated software up to date with the latest security patches. 8. Vendor communication: Stay in close contact with Elektrobit for updates on patches or additional mitigation strategies specific to this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-41925. See article

Oct 1, 2024 at 2:03 PM / Main stream | The Taggart Institute Intel Center
Threat Intelligence Report

CVE-2024-41925 is a critical vulnerability with a CVSS v3 base score of 9.8 and a CVSS v4 base score of 9.3, indicating a high level of severity. The details provided do not specify whether it is being actively exploited in the wild, nor do they mention the availability of proof-of-concept exploits, mitigations, detections, or patches. Additionally, there is no information regarding potential downstream impacts to other third-party vendors or technology. See article

Oct 1, 2024 at 2:03 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 1, 2024 at 2:25 PM
CVE Assignment

NVD published the first details for CVE-2024-41925

Oct 3, 2024 at 11:15 PM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 3, 2024 at 11:20 PM / nvd
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.6%)

Oct 4, 2024 at 10:33 AM
Static CVE Timeline Graph

Affected Systems

Elektrobit/vlan
+null more

Attack Patterns

CAPEC-193: PHP Remote File Inclusion
+null more

References

Optigo Networks ONS-S8 Spectra Aggregation Switch
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code. The following versions of ONS-S8 - Spectra Aggregation Switch, an OT network management device, are affected:

News

October 2024: Biggest Cyber Attacks, Data Breaches, Ransomware Attacks
Henry Schein has finally disclosed a data breach following at least two back-to-back cyber attacks in 2023 by the BlackCat Ransomware gang, revealing that over 160,000 people had their personal information stolen. October 2024 saw several high-profile cyber attacks, ransomware incidents, and data breaches, affecting a range of industries from healthcare and finance to retail and government.
Vulnerability Summary for the Week of September 30, 2024
High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info n/a–n/a An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication. 2024-09-30 10 CVE-2024-42017 cve@mitre.org cve@mitre.org Cisco–Cisco Data Center Network Manager A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient validation of command arguments. An attacker could exploit this vulnerability by submitting crafted commands to an affected REST API endpoint or through the web UI. A successful exploit could allow the attacker to execute arbitrary commands on the CLI of a Cisco NDFC-managed device with network-admin privileges. Note: This vulnerability does not affect Cisco NDFC when it is configured for storage area network (SAN) controller deployment. 2024-10-02 9.9 CVE-2024-20432 ykramarz@cisco.com n/a–n/a The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.
Cyble Urges ICS Vulnerability Fixes for TEM, Mitsubishi, and Delta Electronics
Cyble researchers investigated vulnerabilities in five ICS/OT products this week and identified Mitsubishi Electric, TEM, and Delta Electronics products as top priorities for security teams. Cyble’s weekly industrial control system/operational technology (ICS/OT) vulnerability report for Oct. 1-7 investigated 10 vulnerabilities in five ICS/OT products and identified products from Mitsubishi Electric, TEM, and Delta Electronics as top priorities for patching and mitigation.
US-CERT Vulnerability Summary for the Week of September 30, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
Vulnerability Summary for the Week of September 30, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links.
See 28 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI