Vulnerability · Published Dec 12, 2025 · Assigned by VulnCheck
CVE-2024-58314Atcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI
High 8.8
In plain English
A high-severity OS command injection in 100M IP Phones from ATCOM Technology co., LTD.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 24.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web configuration CGI script that allows attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'cmd' parameter in web_cgi_main.cgi, enabling remote code execution with administrative credentials.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ATCOM Technology co., LTD. | 100M IP Phones | 2.7 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-51742 exploit
- Atcom IP Phone Webpage product
- VulnCheck Advisory: Atcom 2.7.x.x Authenticated Command Injection via Web Configuration CGI third-party-advisory