{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-50625", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-12-11T20:52:29.818Z", "dateReserved": "2024-10-28T00:00:00", "datePublished": "2024-12-09T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-12-09T21:19:01.674182"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://www.digi.com/resources/security"}, {"url": "https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf"}, {"url": "https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-12-11T20:39:52.466020Z", "id": "CVE-2024-50625", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T20:52:29.818Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-50625", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-11T20:39:52.466020Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T20:52:20.699Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://www.digi.com/resources/security"}, {"url": "https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf"}, {"url": "https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-12-09T21:19:01.674182"}}}, "cveMetadata": {"cveId": "CVE-2024-50625", "state": "PUBLISHED", "dateUpdated": "2024-12-11T20:52:29.818Z", "dateReserved": "2024-10-28T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-12-09T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:digi:connectport_lts_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "36E2B8EB-FD51-4EFD-87BC-61841B5B1372", "versionEndExcluding": "1.4.12", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:digi:connectport_lts_16:-:*:*:*:*:*:*:*", "matchCriteriaId": "D927F6A5-D6AA-4AEB-A7E8-CA5A3BE5ED6E", "vulnerable": false}, {"criteria": "cpe:2.3:h:digi:connectport_lts_16_mei:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDCB83B5-1662-47D8-89E9-F64297D235A5", "vulnerable": false}, {"criteria": "cpe:2.3:h:digi:connectport_lts_16_mei_2ac:-:*:*:*:*:*:*:*", "matchCriteriaId": "CCF5F04A-5AE9-4C1B-8F54-820CF6673E12", "vulnerable": false}, {"criteria": "cpe:2.3:h:digi:connectport_lts_32:-:*:*:*:*:*:*:*", "matchCriteriaId": "6F118AD7-F6E3-4F5F-91F6-B52978C0018D", "vulnerable": false}, {"criteria": "cpe:2.3:h:digi:connectport_lts_32_mei:-:*:*:*:*:*:*:*", "matchCriteriaId": "E4D38E1C-90DE-4B19-9CE4-3B9116AE7AE0", "vulnerable": false}, {"criteria": "cpe:2.3:h:digi:connectport_lts_8_mei:-:*:*:*:*:*:*:*", "matchCriteriaId": "78489691-DF52-45FF-BC61-7DDBCB0B56F0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Digi ConnectPort LTS before 1.4.12. A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests. This can lead to arbitrary file uploads within specific directories, potentially enabling privilege escalation when combined with other vulnerabilities."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Digi ConnectPort LTS anterior a la versi\u00f3n 1.4.12. Una vulnerabilidad en el manejo de carga de archivos de una aplicaci\u00f3n web permite la manipulaci\u00f3n de rutas de archivos mediante solicitudes POST. Esto puede provocar cargas de archivos arbitrarias dentro de directorios espec\u00edficos, lo que potencialmente permite la escalada de privilegios cuando se combina con otras vulnerabilidades."}], "id": "CVE-2024-50625", "lastModified": "2025-06-27T16:07:48.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-12-09T22:15:22.610", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.digi.com/getattachment/Resources/Security/Alerts/Digi-ConnectPort-LTS-Firmware-Update/ConnectPort-LTS-KB.pdf"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://www.digi.com/resources/documentation/digidocs/pdfs/90001001.pdf"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://www.digi.com/resources/security"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}