Vulnerability · Published Apr 16, 2024 · Assigned by ONEKEY

CVE-2024-3871Authenticated Remote Command Injection in Delta Electronics DVW

Critical 9.8

In plain English

A critical-severity command injection in DVW-W02W2-E2 from Deltra Electronics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.7%top 22.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Delta Electronics DVW-W02W2-E2 devices expose a web administration interface to users. This interface implements multiple features that are affected by command injections and stack overflows vulnerabilities. Successful exploitation of these flaws would allow remote unauthenticated attackers to gain remote code execution with elevated privileges on the affected devices. This issue affects DVW-W02W2-E2 through version 2.5.2.

Affected products (as reported)

Vendor	Product	Versions
Deltra Electronics	DVW-W02W2-E2	0 – through 2.5.2

Weakness: CWE-77, CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://onekey.com/