CVE-2024-26519

CRITICAL EPSS 20.4%

Published Oct 22, 20241y ago · Modified Jun 17, 20262w ago

9.0 CVSS 3.1

Critical

Published Oct 22, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.

CVSS Details

Base Score

9.0

Exploitability

2.3

Impact

6.0

Vector string

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector Adjacent

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Changed

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

20.4% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-306 Missing Authentication for Critical Function Authentication

References 1

cybercx.com.au https://cybercx.com.au/blog/zero-day-rce-in-netcomm-ntc-221-industrial-iot-m2m-lte-4g-router/

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.