Vulnerability · Published Jul 9, 2024 · Assigned by CERTVDE
CVE-2024-28748ifm: Reading function in Smart PLC allows command injections
High 7.2
In plain English
A high-severity OS command injection in Smart PLC AC14xx Firmware from ifm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.8%top 44.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A remote attacker with high privileges may use a reading file function to inject OS commands.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ifm | Smart PLC AC14xx Firmware | 0 – through V4.3.17 |
| ifm | Smart PLC AC4xxS Firmware | 0 – through V4.3.17 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H