CVE-2024-8684

CVE-2024-8684 is an OS Command Injection vulnerability (CWE-78) in Revolution Pi version 2022-07-28-revpi-buster from KUNBUS GmbH. The issue affects the ‘php/dal.php’ endpoint, specifically through the ‘arrSaveConfig’ parameter, enabling injection of operating system commands. It has a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on integrity and availability.

An authenticated attacker with low privileges (PR:L) can exploit this vulnerability over the network without user interaction. By sending a specially crafted request to the vulnerable endpoint, the attacker can execute arbitrary OS commands on the Revolution Pi device, potentially compromising its integrity and availability, with limited confidentiality impact.

The INCIBE-CERT advisory on multiple vulnerabilities in KUNBUS GmbH's Revolution Pi (https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-kunbus-gmbhs-revolution-pi) provides further details, including mitigation recommendations for affected systems.