CVE-2024-5196

A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file /tools_command.php. The manipulation of the argument cmb_header/txt_command leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-265833 was assigned to this vulnerability.

• CWE-77

• https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/a%2B%26%5BE4%3Flp5%3Fk9_%3D%5D/ARRIS_VAP2500-RCE-tools_command.php.pdfBroken Link
• https://vuldb.com/?ctiid.265833Permissions Required, VDB Entry
• https://vuldb.com/?id.265833Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.335254Third Party Advisory, VDB Entry
• https://github.com/h0e4a0r1t/h0e4a0r1t.github.io/blob/master/2024/a%2B%26%5BE4%3Flp5%3Fk9_%3D%5D/ARRIS_VAP2500-RCE-tools_command.php.pdfBroken Link
• https://vuldb.com/?ctiid.265833Permissions Required, VDB Entry
• https://vuldb.com/?id.265833Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.335254Third Party Advisory, VDB Entry

Published

May 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51953There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-51954There is an improper access control issue in ArcGIS Server v…8.5
• CVE-2024-51956There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-51957There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-51958There is a path traversal vulnerability in ESRI ArcGIS Serve…4.9
• CVE-2024-51959There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-51960There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-51961There is a local file inclusion vulnerability in ArcGIS Serv…7.5
• CVE-2024-51962A SQL injection vulnerability in ArcGIS Server allows an EDI…8.7
• CVE-2024-51963There is a stored Cross-site Scripting vulnerability in ArcG…4.8
• CVE-2024-51966There is a path traversal vulnerability in ESRI ArcGIS Serve…4.9
• CVE-2024-5197There exists interger overflows in libvpx in versions prior …9.1