CVE-2024-28138

—

CVSS 3.1

7.3 high

EPSS

<1%p58

Published

Dec 10, 2024 (Dec 10, 2024)

Modified

Jun 17, 2026

Description

An unauthenticated attacker with network access to the affected device's web interface can execute any system command via the "msg_events.php" script as the www-data user. The HTTP GET parameter "data" is not properly sanitized.

Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news0 stories

No ingested article mentions this CVE yet.