CVE-2024-2854
published 2024-03-24CVE-2024-2854: A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The…
PriorityP270critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.90%
89.1th percentile
A vulnerability classified as critical has been found in Tenda AC18 15.03.05.05. Affected is the function formSetSambaConf of the file /goform/setsambacfg. The manipulation of the argument usbName leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-257778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| tenda | ac18 | — | — |
| tenda | ac18_firmware | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Greynoiseio
NoiseLetter March 2024
blogs_greynoiseio
NoiseLetter March 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2024-27422 kernel: netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
bugzilla·2024-05-17
CVE-2024-27422 CVE-2024-27422 kernel: netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
CVE-2024-27422 kernel: netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
In the Linux kernel, the following vulnerability has been resolved:
netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout
The Linux kernel CVE team has assigned CVE-2024-27422 to this issue.
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024051720-CVE-2024-27422-2854@gregkh/T
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2281088]
---
The result of automatic check (that is developed by Alexander Larkin) for this CVE-2024-27422 is: SKIP No affected files built, so skip this CVE NO - - unknown (where first YES/NO value means if related sources built).
2024-03-24
Published