What is the CVSS score of CVE-2024-28811?

CVE-2024-28811 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.3%.

Hit 7300 Firmware CVE-2024-28811

LOW

Code Injection (CWE-94)

2024-09-30 cve@mitre.org

Code Injection RCE Hit 7300 Firmware

3.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

3.3 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

CVE Published

Sep 30, 2024 - 19:15 cve.org

LOW 3.3

DescriptionCVE.org

An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations.

AnalysisAI

An issue was discovered in Infinera hiT 7300 5.60.50. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations. Affected products include: Nokia Hit 7300 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.