CVE-2024-51115
Published: 05 November 2024
Summary
CVE-2024-51115 is a critical-severity Command Injection (CWE-77) vulnerability in Dcnetworks Dcme-320 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Device CLI (T1059.008); ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
DCME-320 version 7.4.12.90 contains a command injection vulnerability tracked as CVE-2024-51115 and assigned CWE-77. The flaw received a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no requirements for authentication or user interaction, with high impact on confidentiality, integrity, and availability.
Remote attackers can exploit the issue over the network to inject and execute arbitrary operating-system commands on the affected device, resulting in full system compromise without any prior credentials.
A single public reference points to a technical write-up on GitHub that documents the vulnerability but provides no vendor advisory, patch information, or mitigation guidance.
EPSS for the CVE rose from a low baseline to a peak of 0.0986 before receding to its current value of 0.0444, indicating a measurable increase in exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-45286
Vulnerability details
DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in DCME-320 (network device IP interface) enables arbitrary command execution via Network Device CLI.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.