Vulnerability details

CVE-2024-55544

ORing IAP-420

Authenticated Command Injection

CVSS 4.0

8.7High

Official description

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below.

CVSS scores

Score	Version	Source	Vector
8.7High	4.0	CVEProject cvelistV5 (CNA) (CyberDanube)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`

Affected products

Vendor	Product	Versions	Source
ORing	IAP-420	v ≤ 2.01e	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2024-12-10
Last updated: 2025-11-04
State: Published
Assigner (CNA): CyberDanube

Exploit prediction (EPSS)

12.38%

Probability of exploitation in 30 days

96.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')