Vulnerability · Published Sep 26, 2024 · Assigned by icscert
CVE-2024-9166OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver
Critical 9.3
In plain English
A critical-severity OS command injection in Atemio AM 520 HD Full HD Satellite Receiver from Atelmo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)1.6%top 24.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC
Official description
The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Atelmo | Atemio AM 520 HD Full HD Satellite Receiver | 0 – through TitanNit 2.01 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-270-03 government-resource