CVE-2024-41992 is an OS command injection vulnerability in the Wi-Fi Alliance wfa_dut component (used in the Wi-Fi Test Suite) through version 9.0.0. This flaw, stemming from the use of the system() library function, allows for remote code execution as root, exemplified on Arcadyan FMIMG51AX000J devices via traffic to TCP port 8000 or 8080 on a LAN interface, and potentially over WAN on other devices. With a CVSS score of 8.8 (HIGH), it presents a significant risk due to its low attack complexity and complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion, indicating awareness of the vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| N/A | N/A | n/aCNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.