CVE-2024-34852

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34852
F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiver_schedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful exploitation of this vulnerability may allow the attacker to execute system commands.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md Exploit Third Party Advisory
https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:f-logic:datacube3_firmware:1.0:*:*:*:*:*:*:*
cpe:2.3:h:f-logic:datacube3:-:*:*:*:*:*:*:*
History

10 Jun 2025, 17:21

Type Values Removed Values Added
CPE cpe:2.3:h:f-logic:datacube3:-:*:*:*:*:*:*:*
cpe:2.3:o:f-logic:datacube3_firmware:1.0:*:*:*:*:*:*:*
References () https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md - () https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md - Exploit, Third Party Advisory
First Time F-logic datacube3
F-logic
F-logic datacube3 Firmware

21 Nov 2024, 09:19

Type Values Removed Values Added
References () https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md - () https://github.com/Yang-Nankai/Vulnerabilities/blob/main/DataCube3%20Shell%20Code%20Injection.md -

03 Jul 2024, 02:00

Type Values Removed Values Added
CWE CWE-77
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.3

29 May 2024, 13:02

Type Values Removed Values Added
Summary
  • (es) F-logic DataCube3 v1.0 se ve afectado por la inyección de comandos debido a un filtrado inadecuado de cadenas en el punto de ejecución del comando en el archivo ./admin/transceiver_schedule.php. Un atacante remoto no autenticado puede aprovechar esta vulnerabilidad enviando un nombre de archivo que contenga una inyección de comando. La explotación exitosa de esta vulnerabilidad puede permitir al atacante ejecutar comandos del sistema.

28 May 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-28 17:15

Updated : 2025-06-10 17:21

NVD link : CVE-2024-34852

Mitre link : CVE-2024-34852

CVE.ORG link : CVE-2024-34852

JSON object : View

Products Affected

f-logic

  • datacube3
  • datacube3_firmware
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')