CVE-2024-31977

EUVD-2024-29835
Adtran 834-5 11.1.0.101-202106231430, and fixed as of SmartOS Version 12.6.3.1, devices allow OS Command Injection via shell metacharacters to the Ping or Traceroute utility.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
8 HIGH
ADJACENT_NETWORK
LOW
LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
adtransdg_smartos
𝑥
< 12.5.5.1
adtran834-5_firmware
11.1.0.101-202106231430
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz
https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977
https://github.com/actuator/cve/tree/main/AdTran/834-5
https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332
https://drive.proton.me/urls/GXDM5T5NSG#RHa0yVWSKyoz
https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31977
https://github.com/actuator/cve/tree/main/AdTran/834-5