What is the CVSS score of CVE-2024-0552?

CVE-2024-0552 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Smartrobot are affected by CVE-2024-0552?

CVE-2024-0552 presents critical security risk, a injection vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2024-0552?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Smartrobot CVE-2024-0552

CRITICAL

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2024-01-15 twcert@cert.org.tw

RCE Command Injection Smartrobot

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

CVE Published

Jan 15, 2024 - 04:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Intumit inc. SmartRobot's web framwork has a remote code execution vulnerability. An unauthorized remote attacker can exploit this vulnerability to execute arbitrary commands on the remote server.

AnalysisAI

A remote code execution vulnerability exists in Intumit SmartRobot's web framework that allows unauthenticated attackers to execute arbitrary commands on the server without any user interaction. The vulnerability carries a critical CVSS score of 9.8 and is tagged as an RCE, though there is no indication of active exploitation in the wild (not in KEV) or public proof-of-concept availability. The Taiwan CERT has issued an advisory for this vulnerability affecting all versions of the SmartRobot platform.

Technical ContextAI

The vulnerability affects Intumit SmartRobot, identified by CPE cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:* with the wildcard indicating all versions are impacted. The root cause is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), which occurs when software constructs all or part of a command, data structure, or record using externally-influenced input without properly neutralizing special elements that could modify the intended command when sent to a downstream component. In web frameworks, this typically manifests as injection vulnerabilities where user input is passed unsanitized to system commands or interpreters.

RemediationAI

No patch or fixed version has been announced for this vulnerability. Organizations using Intumit SmartRobot should immediately implement network-level controls including placing the application behind a web application firewall (WAF) with rules to detect command injection attempts, restricting network access to trusted IP ranges only, and monitoring for suspicious command execution. Contact Intumit directly for patch availability and refer to the Taiwan CERT advisory at https://www.twcert.org.tw/tw/cp-132-7662-41d50-1.html for updates. Consider taking affected systems offline if they contain sensitive data until a patch is available.