{"id":"CVE-2024-37023","aliases":["EUVD-2024-36395","GHSA-qfm5-c84w-r442"],"status":"published","title":"Vonets WiFi Bridges Command Injection","description":"Multiple OS command injection vulnerabilities affecting Vonets \n\n industrial wifi bridge relays and wifi bridge repeaters, software \nversions 3.3.23.6.9 and prior, enable an authenticated remote attacker \nto execute arbitrary OS commands via various endpoint parameters.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01258,"percentile":0.69823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2024-08-08T19:30:40Z","modified":"2026-06-17T07:37:37Z","products":[{"vendor":"vonets","product":"vap11ac"},{"vendor":"vonets","product":"vap11ac_firmware"},{"vendor":"vonets","product":"vap11g"},{"vendor":"vonets","product":"vap11g-300"},{"vendor":"vonets","product":"vap11g-300_firmware"},{"vendor":"vonets","product":"vap11g-500"},{"vendor":"vonets","product":"vap11g-500_firmware"},{"vendor":"vonets","product":"vap11g-500s"},{"vendor":"vonets","product":"vap11g-500s_firmware"},{"vendor":"vonets","product":"vap11g_firmware"},{"vendor":"vonets","product":"vap11n-300"},{"vendor":"vonets","product":"vap11n-300_firmware"},{"vendor":"vonets","product":"vap11s"},{"vendor":"vonets","product":"vap11s-5g"},{"vendor":"vonets","product":"vap11s-5g_firmware"},{"vendor":"vonets","product":"vap11s_firmware"},{"vendor":"vonets","product":"var11n-300"},{"vendor":"vonets","product":"var11n-300_firmware"},{"vendor":"vonets","product":"var1200-h"},{"vendor":"vonets","product":"var1200-h_firmware"},{"vendor":"vonets","product":"var1200-l"},{"vendor":"vonets","product":"var1200-l_firmware"},{"vendor":"vonets","product":"var600-h"},{"vendor":"vonets","product":"var600-h_firmware"},{"vendor":"vonets","product":"vbg1200"},{"vendor":"vonets","product":"vbg1200_firmware"},{"vendor":"vonets","product":"vga-1000"},{"vendor":"vonets","product":"vga-1000_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-24-214-08","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37023"},{"url":"https://github.com/advisories/GHSA-qfm5-c84w-r442"}],"sources":{"cve":[{"id":"CVE-2024-37023","title":"Vonets WiFi Bridges Command Injection","description":"Multiple OS command injection vulnerabilities affecting Vonets \n\n industrial wifi bridge relays and wifi bridge repeaters, software \nversions 3.3.23.6.9 and prior, enable an authenticated remote attacker \nto execute arbitrary OS commands via various endpoint parameters.","status":"published","published":"2024-08-08T19:30:40.496Z","modified":"2024-08-21T20:04:21.492Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:34:00.585327Z"}],"euvd":[{"id":"EUVD-2024-36395","description":"Multiple OS command injection vulnerabilities affecting Vonets \n\n industrial wifi bridge relays and wifi bridge repeaters, software \nversions 3.3.23.6.9 and prior, enable an authenticated remote attacker \nto execute arbitrary OS commands via various endpoint parameters.","status":"published","published":"2024-08-08T19:30:40Z","modified":"2024-08-21T20:04:21Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-03T00:56:13.735057Z"}],"ghsa":[{"id":"GHSA-qfm5-c84w-r442","title":"Multiple OS command injection vulnerabilities affecting Vonets \n\n industrial wifi bridge relays...","description":"Multiple OS command injection vulnerabilities affecting Vonets \n\n industrial wifi bridge relays and wifi bridge repeaters, software \nversions 3.3.23.6.9 and prior, enable an authenticated remote attacker \nto execute arbitrary OS commands via various endpoint parameters.","status":"published","published":"2024-08-12T15:30:49Z","modified":"2024-08-12T15:31:00Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:57:55.154597Z"}],"nvd":[{"id":"CVE-2024-37023","description":"Multiple OS command injection vulnerabilities affecting Vonets \n\n industrial wifi bridge relays and wifi bridge repeaters, software \nversions 3.3.23.6.9 and prior, enable an authenticated remote attacker \nto execute arbitrary OS commands via various endpoint parameters.","status":"published","published":"2024-08-12T13:38:22.837Z","modified":"2026-06-17T07:37:37.25Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:10:18.563492Z"}]}}