FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-8934

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Published: Oct 31, 2024 / Updated: 19d ago

010
CVSS 6.5EPSS 0.04%Medium
CVE info copied to clipboard

A local user with administrative access rights can enter specialy crafted values for settings at the user interface (UI) of the TwinCAT Package Manager which then causes arbitrary OS commands to be executed.

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Timeline

First Article

Feedly found the first article mentioning CVE-2024-8934. See article

Oct 31, 2024 at 12:57 PM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 31, 2024 at 12:57 PM
CVE Assignment

NVD published the first details for CVE-2024-8934

Oct 31, 2024 at 1:15 PM
CVSS

A CVSS base score of 6.5 has been assigned.

Oct 31, 2024 at 1:20 PM / nvd
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 31, 2024 at 1:31 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.6%)

Nov 1, 2024 at 9:55 AM
Threat Intelligence Report

CVE-2024-8934 is a vulnerability with a CVSS v4 base score of 7.0, indicating a significant level of criticality. The CVSS vector string suggests that it has a high impact on confidentiality, integrity, and availability. The provided information does not specify whether the vulnerability is exploited in the wild, if there are proof-of-concept exploits, or if mitigations, detections, or patches are available. See article

Nov 7, 2024 at 4:32 PM
Static CVE Timeline Graph

Affected Systems

Beckhoff/twincat
+null more

Attack Patterns

CAPEC-108: Command Line Execution through SQL Injection
+null more

References

Beckhoff Automation TwinCAT Package Manager
Cybersecurity and Infrastructure Security Agency CISA / 12d
Successful exploitation this vulnerability could allow a local attacker with administrative access rights to execute arbitrary OS commands on the affected system. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

News

Security Update for Beckhoff Automation TwinCAT Package Manager
Recently Released Plugin Pipeline from Tenable / 4d
Released Last Updated: 11/15/2024 CVEs: CVE-2024-8934 Plugins: 152357 , 211448 , 211449
CISA Highlights Critical ICS Vulnerabilities & Mitigation Tips
OSINT without borders / 5d
The Cybersecurity and Infrastructure Security Agency (CISA) has recently issued a series of security advisories, shedding light on several critical vulnerabilities affecting Industrial Control Systems (ICS). As the ICS vulnerabilities involve components integral to operational technology (OT), their exploitation could lead to severe disruptions in critical sectors, making it imperative for organizations to act swiftly to secure their systems.
Key Industrial Control System Vulnerabilities Identified in Recent CISA Advisories
unSafe.sh - 不安全 / 5d
These ICS vulnerabilities, which affect critical Industrial Control System components from Bosch Rexroth, Delta Electronics, and Beckhoff Automation, target unsuspecting users. The most concerning vulnerabilities include stack-based buffer overflow issues in Delta Electronics’ DIAScreen and a command injection vulnerability in Beckhoff Automation’s TwinCAT Control Package.
Key ICS Vulnerabilities Identified in Latest CISA Advisories
The Cyber Express / 5d
The Cybersecurity and Infrastructure Security Agency (CISA) has recently issued a series of security advisories, shedding light on several critical vulnerabilities affecting Industrial Control Systems (ICS). As the ICS vulnerabilities involve components integral to operational technology (OT), their exploitation could lead to severe disruptions in critical sectors, making it imperative for organizations to act swiftly to secure their systems.
Key Industrial Control System Vulnerabilities Identified in Recent CISA Advisories
Cyble / 5d
These ICS vulnerabilities, which affect critical Industrial Control System components from Bosch Rexroth, Delta Electronics, and Beckhoff Automation, target unsuspecting users. The most concerning vulnerabilities include stack-based buffer overflow issues in Delta Electronics' DIAScreen and a command injection vulnerability in Beckhoff Automation's TwinCAT Control Package.
See 21 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:High
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 6.5(29815)CWE-78(3977)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial