OS Command Injection Vulnerability in Newtec/iDirect Modems

CVE-2024-13502

What is CVE-2024-13502?

The vulnerability arises from improper parsing of incoming data on the commit_multicast page within the modem's web administration interface. This flaw allows attackers to exploit the system by injecting arbitrary shell commands, potentially leading to unauthorized code execution. Specifically, the vulnerable script uses an eval statement in a bash environment, posing significant security risks to the affected Newtec/iDirect modem models.

References