High severity · published Oct 21, 2024
CVE-2024-10202
Wellchoose Administrative Management System - OS Command Injection
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
Administrative Management System from Wellchoose has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Administrative Management System · Wellchoose
0 · source: vendor, NVD, CISA
Affected product
AM
Administrative Management System
Wellchoose
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-10202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-10202
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-8163-b701e-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-8162-dc491-1.html
More from Administrative Management System
8.8
CVE-2024-10201
Wellchoose Administrative Management System - Arbitrary File Upload
7.5
CVE-2024-10200
Wellchoose Administrative Management System - Arbitrary File Read through Path Traversal