CVE-2024-9166 OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

CriticalCVSS 9.3 EPSS 1.6%

Published: 2024-09-26 19:55
Updated: 2026-06-17 11:24
Exploit status: No public exploit known

Description

The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use of the 'getcommand' query within the application, allowing the attacker to gain root access.

Affected products

Product	Affected versions	Fixed in
atelmo Atemio AM 520 HD Full HD Satellite Receiver	<= TitanNit 2.01	No fix listed
atelmo atemio am 520 hd firmware	<= titannit_2.01	No fix listed

References

www.cisa.gov government-resource

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (2)

v4.0 9.3 · icscert
v4.0 9.3 · ics-cert@hq.dhs.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.58% (percentile 75.9)
CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.