What’s Vulnerable › Vulnerabilities

CVE-2024-48073

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-11-08 · updated 2026-06-17
• Weakness: CWE-862

Description

sunniwell HT3300 before 1.0.0.B022.2 is vulnerable to Insecure Permissions. The /usr/local/bin/update program, which is responsible for updating the software in the HT3300 device, is given the execution mode of sudo NOPASSWD. This program is vulnerable to a command injection vulnerability, which could allow an attacker to pass commands to this program via command line arguments to gain elevated root privileges.

Affected products

• Sunniwell Ht3300 Firmware: before 1.0.0.b022.2 — fixed in 1.0.0.b022.2

How to fix

Upgrade to a fixed version: Sunniwell Ht3300 Firmware 1.0.0.b022.2. Check the vendor advisory for mitigations.

References

• https://gist.github.com/Giles-one/56f677b96aab5a67fbe31dd41fd1303d
• https://github.com/Giles-one/sunniwellHT3300PrivilegeEscalation

Get alerted when CVE-2024-48073 or the next vulnerability affects your stack