diff --git a/cves/2024/11xxx/CVE-2024-11654.json b/cves/2024/11xxx/CVE-2024-11654.json new file mode 100644 index 000000000000..1042149ce035 --- /dev/null +++ b/cves/2024/11xxx/CVE-2024-11654.json @@ -0,0 +1,175 @@ +{ + "dataType": "CVE_RECORD", + "dataVersion": "5.1", + "cveMetadata": { + "cveId": "CVE-2024-11654", + "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "state": "PUBLISHED", + "assignerShortName": "VulDB", + "dateReserved": "2024-11-24T15:13:57.614Z", + "datePublished": "2024-11-25T04:00:27.286Z", + "dateUpdated": "2024-11-25T04:00:27.286Z" + }, + "containers": { + "cna": { + "providerMetadata": { + "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", + "shortName": "VulDB", + "dateUpdated": "2024-11-25T04:00:27.286Z" + }, + "title": "EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection", + "problemTypes": [ + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-77", + "lang": "en", + "description": "Command Injection" + } + ] + }, + { + "descriptions": [ + { + "type": "CWE", + "cweId": "CWE-74", + "lang": "en", + "description": "Injection" + } + ] + } + ], + "affected": [ + { + "vendor": "EnGenius", + "product": "ENH1350EXT", + "versions": [ + { + "version": "20241118", + "status": "affected" + } + ] + }, + { + "vendor": "EnGenius", + "product": "ENS500-AC", + "versions": [ + { + "version": "20241118", + "status": "affected" + } + ] + }, + { + "vendor": "EnGenius", + "product": "ENS620EXT", + "versions": [ + { + "version": "20241118", + "status": "affected" + } + ] + } + ], + "descriptions": [ + { + "lang": "en", + "value": "A vulnerability classified as critical has been found in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT up to 20241118. This affects an unknown part of the file /admin/network/diag_traceroute6. The manipulation of the argument diag_traceroute6 leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way." + }, + { + "lang": "de", + "value": "Es wurde eine Schwachstelle in EnGenius ENH1350EXT, ENS500-AC and ENS620EXT bis 20241118 entdeckt. Sie wurde als kritisch eingestuft. Es betrifft eine unbekannte Funktion der Datei /admin/network/diag_traceroute6. Durch Manipulieren des Arguments diag_traceroute6 mit unbekannten Daten kann eine command injection-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk erfolgen. Der Exploit steht zur öffentlichen Verfügung." + } + ], + "metrics": [ + { + "cvssV4_0": { + "version": "4.0", + "baseScore": 5.1, + "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_1": { + "version": "3.1", + "baseScore": 4.7, + "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV3_0": { + "version": "3.0", + "baseScore": 4.7, + "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", + "baseSeverity": "MEDIUM" + } + }, + { + "cvssV2_0": { + "version": "2.0", + "baseScore": 5.8, + "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P" + } + } + ], + "timeline": [ + { + "time": "2024-11-24T00:00:00.000Z", + "lang": "en", + "value": "Advisory disclosed" + }, + { + "time": "2024-11-24T01:00:00.000Z", + "lang": "en", + "value": "VulDB entry created" + }, + { + "time": "2024-11-24T16:19:25.000Z", + "lang": "en", + "value": "VulDB entry last update" + } + ], + "credits": [ + { + "lang": "en", + "value": "liutong (VulDB User)", + "type": "reporter" + } + ], + "references": [ + { + "url": "https://vuldb.com/?id.285975", + "name": "VDB-285975 | EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection", + "tags": [ + "vdb-entry", + "technical-description" + ] + }, + { + "url": "https://vuldb.com/?ctiid.285975", + "name": "VDB-285975 | CTI Indicators (IOB, IOC, TTP, IOA)", + "tags": [ + "signature", + "permissions-required" + ] + }, + { + "url": "https://vuldb.com/?submit.446637", + "name": "Submit #446637 | EnGenius ENS500-AC 3.7.20 Command Injection", + "tags": [ + "third-party-advisory" + ] + }, + { + "url": "https://k9u7kv33ub.feishu.cn/wiki/YrKfwHqLjijPeYkMTQfcdhrBnyg?from=from_copylink", + "tags": [ + "exploit" + ] + } + ] + } + } +} \ No newline at end of file diff --git a/cves/delta.json b/cves/delta.json index c5a514944837..ad3db8c0be61 100644 --- a/cves/delta.json +++ b/cves/delta.json @@ -1,27 +1,14 @@ { - "fetchTime": "2024-11-25T03:59:59.631Z", - "numberOfChanges": 3, + "fetchTime": "2024-11-25T04:10:50.138Z", + "numberOfChanges": 1, "new": [ { - "cveId": "CVE-2024-11483", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-11483", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11483.json", - "dateUpdated": "2024-11-25T03:54:34.342Z" - } - ], - "updated": [ - { - "cveId": "CVE-2024-2467", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-2467", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/2xxx/CVE-2024-2467.json", - "dateUpdated": "2024-11-25T03:59:50.725Z" - }, - { - "cveId": "CVE-2024-9355", - "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-9355", - "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9355.json", - "dateUpdated": "2024-11-25T03:54:36.483Z" + "cveId": "CVE-2024-11654", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-11654", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11654.json", + "dateUpdated": "2024-11-25T04:00:27.286Z" } ], + "updated": [], "error": [] } \ No newline at end of file diff --git a/cves/deltaLog.json b/cves/deltaLog.json index ca2ae249273f..ace01ed408c2 100644 --- a/cves/deltaLog.json +++ b/cves/deltaLog.json @@ -1,4 +1,18 @@ [ + { + "fetchTime": "2024-11-25T04:10:50.138Z", + "numberOfChanges": 1, + "new": [ + { + "cveId": "CVE-2024-11654", + "cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-11654", + "githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/11xxx/CVE-2024-11654.json", + "dateUpdated": "2024-11-25T04:00:27.286Z" + } + ], + "updated": [], + "error": [] + }, { "fetchTime": "2024-11-25T03:59:59.631Z", "numberOfChanges": 3,