High severity · published Oct 8, 2024
CVE-2024-45880
A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below
8.0
CVSS
0.9%
EPSS
No
On KEV
Description
A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. The vulnerability is present in the SetStationSettings function. The system directly invokes the system function to execute commands for setting parameters such as MAC address without proper input filtering. This allows malicious users to inject and execute arbitrary commands.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cx2l Firmware · Motorola
through 1.0.2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-45880
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-45880
github.com
https://github.com/N1nEmAn/wp/blob/main/m0tOrol%40-Cx2l.pdf
More from Cx2l Firmware
8.8
CVE-2023-31531
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the tomography_ping_number parameter
8.8
CVE-2023-31530
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the smartqos_priority_devices parameter
8.8
CVE-2023-31529
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the system_time_timezone parameter
8.8
CVE-2023-31528
Motorola CX2L Router 1.0.1 was discovered to contain a command injection vulnerability via the staticroute_list parameter
5.3
CVE-2024-25360
A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafted request to device_web_ip