CVE-2024-45179

An issue was discovered in za-internet C-MOR Video Surveillance 5.2401 and 6.00PL01. Due to insufficient input validation, the C-MOR web interface is vulnerable to OS command injection attacks. It was found out that different functionality is vulnerable to OS command injection attacks, for example for generating new X.509 certificates, or setting the time zone. These OS command injection vulnerabilities in the script generatesslreq.pml can be exploited as a low-privileged authenticated user to execute commands in the context of the Linux user www-data via shell metacharacters in HTTP POST data (e.g., the city parameter). The OS command injection vulnerability in the script settimezone.pml or setdatetime.pml (e.g., via the year parameter) requires an administrative user for the C-MOR web interface. By also exploiting a privilege-escalation vulnerability, it is possible to execute commands on the C-MOR system with root privileges.

• CWE-1289

• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2024-030.txtExploit, Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Sep/23Exploit, Mailing List, Third Party Advisory

Published

Oct 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45173An issue was discovered in za-internet C-MOR Video Surveilla…8.8
• CVE-2024-45174An issue was discovered in za-internet C-MOR Video Surveilla…8.1
• CVE-2024-45175An issue was discovered in za-internet C-MOR Video Surveilla…8.8
• CVE-2024-45176An issue was discovered in za-internet C-MOR Video Surveilla…6.1
• CVE-2024-45177An issue was discovered in za-internet C-MOR Video Surveilla…5.4
• CVE-2024-45178An issue was discovered in za-internet C-MOR Video Surveilla…7.1
• CVE-2024-4518A vulnerability was found in Campcodes Complete Web-Based Sc…6.1
• CVE-2024-45180SquaredUp DS for SCOM 6.2.1.11104 allows XSS.5.4
• CVE-2024-45181An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS Wib…7.8
• CVE-2024-45182An issue was discovered in WibuKey64.sys in WIBU-SYSTEMS Wib…5.5
• CVE-2024-45183An issue was discovered in Samsung Mobile Processor Exynos 2…6.5
• CVE-2024-45184An issue was discovered in Samsung Mobile Processor, Wearabl…6.2