A remote, unauthenticated attacker may be able to send crafted messages
to the web server of the Commend WS203VICM causing the system to
restart, interrupting service.
A remote, unauthenticated attacker may be able to send crafted messages
to the web server of the Commend WS203VICM causing the system to
restart, interrupting service.
Although this is an end-of-life product, Commend has created new firmware version WS-CM 2.0 https://clibrary-online.commend.com/ to
address the first two issues. The new firmware can be loaded via the
program "IP Station Config". To install the firmware, follow the
instructions below:
* Log in to the Commend web-portal.
* Download and extract the "Terminals Software Package".
* In "IP Station Config", select the stations to be updated in the table.
* Go to: Menu Station > Firmware Download
* Select the file "WS-CM 2.0.geh" from the folder "WS-CM" and click on the button Open.
For additional information, please visit CSA-2024-42 on Commend's cybersecurity website. https://clibrary-online.commend.com/en/cyber-security/security-advisories.html
Configurations
Workarounds
Exploits
Credits
finder
Aarón Flecha Menéndez of S21sec reported these vulnerabilities to CISA.
A remote, unauthenticated attacker may be able to send crafted messages
to the web server of the Commend WS203VICM causing the system to
restart, interrupting service.
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Command Injection
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.