CVE-2024-34852

F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful exploitation of this vulnerability may allow the attacker to execute system commands.

Score

CVSS 3.1 6.3 Medium

Status

Analyzed - cve@mitre.org

Published

2024-05-28

Last modified

2025-02-13

Weaknesses

CWE-77

Affected products

• Datacube3 (F-logic)
• Datacube3 Firmware (F-logic)

References

• https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md