CVE-2024-48073
Critical
Description
sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges.
SeverityCritical
CVSS9.8
Exploit probability—
ProductSunniwell Ht3300 Firmware
PublishedNov 8, 2024
First seenNov 8, 2024
Weakness typeCWE-862Missing authorization
How to fix
Update
- sunniwell ht3300_firmware1.0.0.b022.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sunniwell ht3300_firmware | v < 1.0.0.b022.2 | 1.0.0.b022.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.