High severity · published Dec 20, 2024
CVE-2024-56334
Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation
7.8
CVSS
0.7%
EPSS
No
On KEV
Description
systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the `getWindowsIEEE8021x` function. This means that malicious content in the SSID can be executed as OS commands. This vulnerability may enable an attacker, depending on how the package is used, to perform remote code execution or local privilege escalation. This issue has been addressed in version 5.23.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SY
systeminformation · sebhildebrandt
< 5.23.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-56334
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-56334
github.com
https://github.com/sebhildebrandt/systeminformation/commit/f7af0a67b78e7894335a6cad510566a25e06ae41
github.com
https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-cvv5-9h9w-qp2m
More from systeminformation
7.8
CVE-2021-21315
Command Injection Vulnerability
8.8
CVE-2026-50289
systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
7.8
CVE-2026-116576
systeminformation: Windows command injection in services() through Unicode quotation marks
7.8
CVE-2026-44724
systeminformation: Linux command injection in networkInterfaces() via unsanitized NetworkManager connection profile name
6.5
CVE-2026-116674
systeminformation: Prototype pollution in `networkStats()` via the interface name