CVE-2024-8684

Summary

CVE-2024-8684 is a newly disclosed OS Command Injection vulnerability affecting the Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. An authenticated attacker can exploit this vulnerability by sending malicious input to the 'php/dal.php' endpoint, specifically the 'arrSaveConfig' parameter. Successful exploitation grants the attacker the ability to execute OS commands on the device, potentially leading to serious security consequences. This vulnerability highlights the importance of regularly updating and securing IoT devices to protect against such threats.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.