VDE-2024-032
Last update
03.07.2024 15:33
Published at
03.07.2024 11:00
Vendor(s)
Helmholz GmbH & Co. KG
External ID
VDE-2024-032
CSAF Document
Summary
There exists a vulnerability in all REX 100 devices with firmware <= 2.2.11 that allows an authenticated attacker to execute arbitrary system commands via GET requests.
Update: 03.07.2024 3:30pm
In section Reported by Sebastian Dietz (CyberDanube) was added.
Impact
See CVE description.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| REX 100 | Firmware <=2.2.11 |
Vulnerabilities
Expand / Collapse all
Published
22.09.2025 14:58
Severity
Weakness
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary
A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command.
References
Mitigation
As this is an authenticated exploit, you can mitigate it by making sure that no malicious actor can login to a vulnerable device.
Remediation
Update to latest version: 2.2.13
Revision History
| Version | Date | Summary |
|---|---|---|
| 1.0.0 | 03.07.2024 11:00 | Initial revision. |
| 1.0.1 | 03.07.2024 15:33 | In section Reported by Sebastian Dietz (CyberDanube) was added. |