Cyber Posture

CVE-2024-58287

HighPublic PoC

Published: 11 December 2025

Published
11 December 2025
Modified
20 January 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0094 76.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmap_cmd parameter with malicious base64-encoded payloads to achieve remote code execution during scan…

more

engine configuration.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly prevents command injection by implementing input validation mechanisms on the nmap_cmd parameter to reject malicious base64-encoded payloads.

SI-2 Flaw Remediation good match
prevent

Remediates the specific command injection flaw in reNgine 2.2.0 through timely identification, reporting, and patching.

CM-5 Access Restrictions for Change partial match
prevent

Restricts access to scan engine configuration changes, limiting low-privilege authenticated users from reaching the vulnerable nmap_cmd parameter.

Security SummaryAI

CVE-2024-58287 is a command injection vulnerability (CWE-78) affecting reNgine version 2.2.0, specifically in the nmap_cmd parameter of the scan engine configuration. This flaw enables authenticated attackers to execute arbitrary commands by modifying the parameter with malicious base64-encoded payloads, resulting in remote code execution during scan engine configuration. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H), indicating high severity due to its network accessibility, low attack complexity, and potential for significant impacts on confidentiality, integrity, and availability.

Authenticated attackers with low privileges (PR:L) can exploit this vulnerability over the network without user interaction. By injecting crafted payloads into the nmap_cmd parameter, they achieve remote code execution on the affected reNgine server during the configuration of scan engines, potentially compromising the entire system.

Advisories and resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/rengine-authenticated-command-injection-via-scan-engine-configuration, an exploit published at https://www.exploit-db.com/exploits/52081, the reNgine GitHub repository at https://github.com/yogeshojha/rengine, and the project wiki at https://rengine.wiki/, provide further details on the vulnerability, proof-of-concept exploits, and potential mitigation or patching guidance.

Details

CWE(s)
CWE-78

Affected Products

yogeshojha
rengine
2.2.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Command injection in web-based reNgine enables exploitation of public-facing application (T1190) for remote code execution via Unix shell (T1059.004) and potential privilege escalation from low privileges to system compromise (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References