CVE-2024-5421 describes a critical command injection vulnerability in utnserver Pro, utnserver ProMAX, and INU-100 devices running version 20.1.22 and below, stemming from inadequate input validation in their web interface. This flaw allows an authenticated attacker to execute arbitrary operating system commands, leading to high impact on confidentiality, integrity, and availability. With a CVSSv4 score of 8.7 (High), the vulnerability is easily exploitable over the network with low privileges and no user interaction. While there is no evidence of active exploitation or public Metasploit/ExploitDB modules, Nuclei templates exist for file exposure, and its high EPSS score suggests a significant probability of future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| SEH Computertechnik | INU-100 | >= 0, <= 20.1.22CNA affecteddefault unaffected | |
| SEH Computertechnik | Utnserver Pro | >= 0, <= 20.1.22CNA affecteddefault unaffected | |
| SEH Computertechnik | Utnserver ProMAX | >= 0, <= 20.1.22CNA affecteddefault unaffected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.