High severity · published Nov 29, 2024
CVE-2024-11013
Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V…
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UI
UNIVERGE IX · NEC Corporation
from Ver9.2 to Ver10.10.21; for Ver10.8 up to Ver10.8.27; for Ver10.9 up to Ver10.9.14 · source: vendor, CISA
UI
UNIVERGE IX-R/IX-V · NEC Corporation
Ver1.2.15 and earlier · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-11013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-11013
jpn.nec.com
https://jpn.nec.com/security-info/secinfo/nv24-009_en.html
More from UNIVERGE IX
5.1
CVE-2025-8153
Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to…
4.3
CVE-2024-11014
Cross-site request forgery (CSRF) vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27 and for Ver10.9 up to Ver10.9.14 allows a…