CVE-2024-31485

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V5.30 SICORE Base system versions prior to V1.3.0

Description: A command injection vulnerability exists due to missing server-side input sanitation in the web interface of affected devices. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.

Recommendations: For CPCI85 Central Processing/Communication versions prior to V5.30, update to version V5.30 or later. For SICORE Base system versions prior to V1.3.0, update to version V1.3.0 or later. As a temporary workaround, consider restricting access to the web interface of affected devices to minimize the risk of exploitation.