CVE-2024-8807: Cohesive VNS3 Unauthenticated Command Injection RCE

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability 2. Vulnerability IDs: - ZDI-24-1231 - ZDI-CAN-24176 3. CVE ID: CVE-2024-8807 4. CVSS Score: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 5. Affected Vendor: Cohesive Networks 6. Affected Product: VNS3 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to execute arbitrary code on affected Cohesive Networks VNS3 installations. - No authentication is required to exploit this vulnerability. - The issue exists in the web service that listens on the default TCP port 8000. This service does not properly validate user-supplied strings, which are then used in system calls. Attackers can leverage this to execute code with root privileges. 8. Additional Details: - Cohesive Networks has released updates to fix this vulnerability. - More details are available at: https://cohesive.net/support/security-responses/ 9. Disclosure Timeline: - 2024-07-24: Vulnerability reported to vendor - 2024-09-17: Coordinated public disclosure of vulnerability advisory - 2024-09-17: Advisory update published 10. Credit: - Mehmet INCE (@mdisec) from PRODAFT.com This information provides a detailed description of the vulnerability, including its severity, affected systems and vendors, exploitation conditions, and vendor response measures.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-8807: Cohesive VNS3 Unauthenticated Command Injection RCE