CVE-2024-52777

Name of the Vulnerable Software and Affected Versions DCME-320 versions 7.4.12.90 and earlier DCME-520 versions 9.25.5.11 and earlier DCME-320-L versions 9.3.5.26 and earlier DCME-720 versions 9.1.5.11 and earlier

Description The issue allows for Remote Code Execution via the /function/system/basic/license update.php endpoint. This can be exploited by sending malicious input to this endpoint, potentially allowing an attacker to execute arbitrary code on the affected system.

Recommendations For DCME-320 versions 7.4.12.90 and earlier, update to a version later than 7.4.12.90. For DCME-520 versions 9.25.5.11 and earlier, update to a version later than 9.25.5.11. For DCME-320-L versions 9.3.5.26 and earlier, update to a version later than 9.3.5.26. For DCME-720 versions 9.1.5.11 and earlier, update to a version later than 9.1.5.11. As a temporary workaround, consider restricting access to the /function/system/basic/license update.php endpoint until a patch is available.