CVE-2024-5421

published 2024-06-04

CVE-2024-5421: Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command…

Priority P2 61 high 8.7 CVSS 4.0

AV N AC L AT N PR L UI N VC H VI H VA H SC N SI N SA L E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Missing input validation and OS command integration of the input in the utnserver Pro, utnserver ProMAX, INU-100 web-interface allows authenticated command injection.This issue affects utnserver Pro, utnserver ProMAX, INU-100 version 20.1.22 and below.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
seh_computertechnik	inu-100	<= 20.1.22	—
seh_computertechnik	utnserver_pro	<= 20.1.22	—
seh_computertechnik	utnserver_promax	<= 20.1.22	—

Detection & IOCs extracted from sources · hover to see the quote

url /info/dir?/

other shodan-query: "SEH HTTP Server"

• → HTTP GET request to /info/dir?/ path is the exploit trigger for the file disclosure vulnerability
• → Response body contains '/var/tmp', 'File System Info', and 'face="courier' when exploitation is successful
• → HTTP 200 status code is expected on successful exploitation of the file disclosure endpoint
• → Shodan fingerprint 'SEH HTTP Server' can be used to identify exposed vulnerable devices on the internet

• · Authentication is required to exploit this vulnerability; unauthenticated access will not trigger the file disclosure ↗
• · Affected versions are 20.1.22 and below; devices running later versions are not vulnerable ↗
• · The NVD description characterises this as an OS command injection (CWE-78), while the Nuclei template and exploit PoC demonstrate it as a file/directory disclosure — both attack surfaces exist in the same version ↗

CVSS provenance

nvd v4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vendor_oracle 6.5 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78