BaseFortify

Publication date: 2025-12-11

Last updated on: 2025-12-11

Assigner: VulnCheck

Description

reNgine 2.2.0 contains a command injection vulnerability in the nmap_cmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmap_cmd parameter with malicious base64-encoded payloads to achieve remote code execution during scan engine configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-11

Last Modified

2025-12-11

Generated

2026-07-07

AI Q&A

2025-12-12

EPSS Evaluated

2026-07-06

NVD

CVE-2024-58287

Affected Vendors & Products

Vendor	Product	Version / Range
re_ngin	re_ngin	2.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is a command injection flaw in reNgine 2.2.0 within the nmap_cmd parameter of the scan engine configuration. Authenticated attackers can exploit this by modifying the nmap_cmd parameter with malicious base64-encoded payloads, allowing them to execute arbitrary commands remotely during scan engine configuration.

Impact Analysis

The vulnerability can allow an authenticated attacker to execute arbitrary commands on the affected system remotely. This can lead to unauthorized control over the system, potential data compromise, disruption of services, and further exploitation within the network.

Hi! I’m here to help you understand CVE-2024-58287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70