CVE-2024-5743 (GCVE-0-2024-5743)
Vulnerability from cvelistv5 – Published: 2025-01-13 17:25 – Updated: 2025-01-13 18:25
VLAI?
Title
Command Injection Vulnerability
Summary
An attacker could exploit the 'Use of Password Hash With Insufficient Computational Effort' vulnerability in EveHome Eve Play to execute arbitrary code.
This issue affects Eve Play: through 1.1.42.
Severity ?
9.8 (Critical)
CWE
- CWE-916 - Use of Password Hash With Insufficient Computational Effort
Assigner
References
Credits
ABB PSIRT thanks the following parties for their efforts: Ville Salmela for reporting the vulnerabilities through responsible disclosure.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-13T18:25:40.080233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-13T18:25:58.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Eve Play",
"vendor": "EveHome",
"versions": [
{
"lessThanOrEqual": "1.1.42",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "ABB PSIRT thanks the following parties for their efforts: Ville Salmela for reporting the vulnerabilities through responsible disclosure."
}
],
"datePublic": "2025-01-12T19:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eAn attacker could exploit the \u0027Use of Password Hash With Insufficient Computational Effort\u0027 vulnerability in EveHome Eve Play to execute arbitrary code.\u003c/span\u003e\n\n\u003cp\u003eThis issue affects Eve Play: through 1.1.42.\u003c/p\u003e"
}
],
"value": "An attacker could exploit the \u0027Use of Password Hash With Insufficient Computational Effort\u0027 vulnerability in EveHome Eve Play to execute arbitrary code.\n\nThis issue affects Eve Play: through 1.1.42."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-916",
"description": "CWE-916 Use of Password Hash With Insufficient Computational Effort",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-13T17:25:49.740Z",
"orgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"shortName": "ABB"
},
"references": [
{
"url": "https://www.evehome.com/en-us/security-content"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The issue is resolved in the version to:\u0026nbsp;\u003cspan style=\"background-color: var(--wht);\"\u003e1.1.43 or later.\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "The issue is resolved in the version to:\u00a01.1.43 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Command Injection Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2b718523-d88f-4f37-9bbd-300c20644bf9",
"assignerShortName": "ABB",
"cveId": "CVE-2024-5743",
"datePublished": "2025-01-13T17:25:49.740Z",
"dateReserved": "2024-06-07T12:34:00.963Z",
"dateUpdated": "2025-01-13T18:25:58.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"An attacker could exploit the \u0027Use of Password Hash With Insufficient Computational Effort\u0027 vulnerability in EveHome Eve Play to execute arbitrary code.\\n\\nThis issue affects Eve Play: through 1.1.42.\"}]",
"id": "CVE-2024-5743",
"lastModified": "2025-01-13T18:15:19.517",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"cybersecurity@ch.abb.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
"published": "2025-01-13T18:15:19.517",
"references": "[{\"url\": \"https://www.evehome.com/en-us/security-content\", \"source\": \"cybersecurity@ch.abb.com\"}]",
"sourceIdentifier": "cybersecurity@ch.abb.com",
"vulnStatus": "Received",
"weaknesses": "[{\"source\": \"cybersecurity@ch.abb.com\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-916\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-5743\",\"sourceIdentifier\":\"cybersecurity@ch.abb.com\",\"published\":\"2025-01-13T18:15:19.517\",\"lastModified\":\"2025-01-13T18:15:19.517\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An attacker could exploit the \u0027Use of Password Hash With Insufficient Computational Effort\u0027 vulnerability in EveHome Eve Play to execute arbitrary code.\\n\\nThis issue affects Eve Play: through 1.1.42.\"},{\"lang\":\"es\",\"value\":\"Un atacante podr\u00eda aprovechar la vulnerabilidad \\\"Uso de hash de contrase\u00f1a con esfuerzo computacional insuficiente\\\" en EveHome Eve Play para ejecutar c\u00f3digo arbitrario. Este problema afecta a Eve Play: hasta la versi\u00f3n 1.1.42.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cybersecurity@ch.abb.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cybersecurity@ch.abb.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-916\"}]}],\"references\":[{\"url\":\"https://www.evehome.com/en-us/security-content\",\"source\":\"cybersecurity@ch.abb.com\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-5743\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-13T18:25:40.080233Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-13T18:25:50.814Z\"}}], \"cna\": {\"title\": \"Command Injection Vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"ABB PSIRT thanks the following parties for their efforts: Ville Salmela for reporting the vulnerabilities through responsible disclosure.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"EveHome\", \"product\": \"Eve Play\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"1.1.42\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The issue is resolved in the version to:\\u00a01.1.43 or later.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"The issue is resolved in the version to:\u0026nbsp;\u003cspan style=\\\"background-color: var(--wht);\\\"\u003e1.1.43 or later.\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\\n\\n\\n\\n\\n\\n\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2025-01-12T19:31:00.000Z\", \"references\": [{\"url\": \"https://www.evehome.com/en-us/security-content\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"An attacker could exploit the \u0027Use of Password Hash With Insufficient Computational Effort\u0027 vulnerability in EveHome Eve Play to execute arbitrary code.\\n\\nThis issue affects Eve Play: through 1.1.42.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eAn attacker could exploit the \u0027Use of Password Hash With Insufficient Computational Effort\u0027 vulnerability in EveHome Eve Play to execute arbitrary code.\u003c/span\u003e\\n\\n\u003cp\u003eThis issue affects Eve Play: through 1.1.42.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-916\", \"description\": \"CWE-916 Use of Password Hash With Insufficient Computational Effort\"}]}], \"providerMetadata\": {\"orgId\": \"2b718523-d88f-4f37-9bbd-300c20644bf9\", \"shortName\": \"ABB\", \"dateUpdated\": \"2025-01-13T17:25:49.740Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-5743\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-13T18:25:58.273Z\", \"dateReserved\": \"2024-06-07T12:34:00.963Z\", \"assignerOrgId\": \"2b718523-d88f-4f37-9bbd-300c20644bf9\", \"datePublished\": \"2025-01-13T17:25:49.740Z\", \"assignerShortName\": \"ABB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…