Vulnerability Details CVE-2024-34852
F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful exploitation of this vulnerability may allow the attacker to execute system commands.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.4%
CVSS Severity
CVSS v3 Score 6.3
References
Products affected by CVE-2024-34852
-
cpe:2.3:h:f-logic:datacube3:-
-
cpe:2.3:o:f-logic:datacube3_firmware:1.0