CVE-2024-9166

OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.

Affected

Atelmo · Atemio AM 520 HD Full HD Satellite Receiver

CVSS v4.0 HQ

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

1.58% chance of exploitation in the next 30 days, 75th percentile

Nuclei

critical · CWE-78

Published

2024-09-26

Proof-of-concept exploits (1)

• Andrysqui/CVE-2024-91664★ · 2024-10-01

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-9166.yaml

References

• CVE Record
• NVD entry