CVE-2024-10119: SECOM WRTM326 - OS Command Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-18 · updated 2026-06-17
Weakness: CWE-78

Description

The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system commands by sending crafted requests.

Affected products

SECOM WRTM326: through 2.3.20

References

https://www.twcert.org.tw/en/cp-139-8157-e0461-2.html
https://www.twcert.org.tw/tw/cp-132-8156-81c9d-1.html

Get alerted when CVE-2024-10119 or the next vulnerability affects your stack