CVE-2024-0552
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Intumit inc. SmartRobot's web framwork has a remote code execution vulnerability. An unauthorized remote attacker can exploit this vulnerability to execute arbitrary commands on the remote server.
Analysis
A remote code execution vulnerability exists in Intumit SmartRobot's web framework that allows unauthenticated attackers to execute arbitrary commands on the server without any user interaction. The vulnerability carries a critical CVSS score of 9.8 and is tagged as an RCE, though there is no indication of active exploitation in the wild (not in KEV) or public proof-of-concept availability. The Taiwan CERT has issued an advisory for this vulnerability affecting all versions of the SmartRobot platform.
Technical Context
The vulnerability affects Intumit SmartRobot, identified by CPE cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:* with the wildcard indicating all versions are impacted. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which occurs when software constructs all or part of a command, data structure, or record using externally-influenced input without properly neutralizing special elements that could modify the intended command when sent to a downstream component. In web frameworks, this typically manifests as injection vulnerabilities where user input is passed unsanitized to system commands or interpreters.
Affected Products
All versions of Intumit SmartRobot web framework are affected according to the CPE designation cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:*. The vulnerability was reported by Taiwan CERT ([email protected]) with advisory details available at https://www.twcert.org.tw/tw/cp-132-7662-41d50-1.html. No specific version numbers or patch information has been provided by the vendor at this time.
Remediation
No patch or fixed version has been announced for this vulnerability. Organizations using Intumit SmartRobot should immediately implement network-level controls including placing the application behind a web application firewall (WAF) with rules to detect command injection attempts, restricting network access to trusted IP ranges only, and monitoring for suspicious command execution. Contact Intumit directly for patch availability and refer to the Taiwan CERT advisory at https://www.twcert.org.tw/tw/cp-132-7662-41d50-1.html for updates. Consider taking affected systems offline if they contain sensitive data until a patch is available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today