Command Injection Vulnerability in Vivotek CC8160 Products
CVE-2024-7440
9.8CRITICAL
What is CVE-2024-7440?
A serious command injection vulnerability has been identified in Vivotek's CC8160 product line, specifically in the upload_file.cgi function associated with the getenv operation. By crafting a malicious QUERY_STRING argument, attackers can execute arbitrary commands on the affected device. This security flaw primarily impacts versions of the product that are no longer supported by Vivotek, leaving them vulnerable to exploitation through remote access. Users of these products should be aware of the risks and consider upgrading to supported versions or alternative solutions to mitigate potential threats.