CVE-2024-55547
Published: 10 December 2024
Summary
CVE-2024-55547 is a critical-severity Command Injection (CWE-77) vulnerability in Oringnet Iap-420 Firmware. Its CVSS base score is 9.3 (Critical).
Operationally, ranked in the top 3.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-55547 is a command injection vulnerability (CWE-77) affecting SNMP objects in NET-SNMP as implemented in the ORing IAP-420 industrial access point. The flaw impacts all versions through firmware 2.01e and carries a CVSS 4.0 score of 9.3, reflecting network-accessible attack vectors that require no authentication or user interaction.
An unauthenticated attacker with network access to the device can supply crafted SNMP requests that result in arbitrary command execution. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected appliance, enabling remote takeover without prior credentials.
The EPSS score for this CVE has climbed to a peak of 0.3721 (currently 0.3143), indicating that exploitation interest emerged after public disclosure. Details on the issue and any vendor-specific guidance appear in the advisories published at cyberdanube.com and seclists.org.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-52801
Vulnerability details
SNMP objects in NET-SNMP used in ORing IAP-420 allows Command Injection. This issue affects IAP-420: through 2.01e.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.