CVE-2024-7120: Raisecom MSG Gateway Web Interface OS Command Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high, but the CVSS 4.0 base score is 5.3 (medium) and exploitation requires low privileges, so it is not critical.

What it is

Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 firmware 3.90 contain an OS command injection flaw in list_base_config.php of the web interface, reachable by manipulating the template argument. The vulnerability is remotely exploitable and a public exploit has been disclosed, so unpatched gateways are at immediate risk.

Impact

An authenticated attacker can execute arbitrary operating system commands on the gateway, potentially gaining full control of the device and its network position. This can lead to configuration tampering, traffic interception, or use of the device as a pivot into the internal network.

Attack surface

The flaw is reached over the network through the web interface by sending a crafted request to list_base_config.php with a malicious template parameter. The CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), so a valid low-privileged session is needed.

Exploitation

A public exploit is referenced (Exploit tag) and EPSS is 0.934 (99.8th percentile), indicating high likelihood of exploitation; the CVE is not listed in CISA KEV.

What to do

• Apply the vendor patch or fixed firmware for the affected Raisecom MSG models as soon as it is available.
• If patching is not immediately possible, restrict access to the web interface to trusted management networks and disable remote management from untrusted zones.
• Enforce strong authentication and least privilege on web interface accounts; remove or disable unused accounts.
• Monitor vendor advisories and replace end-of-support devices that will not receive a fix.
• Segment gateway management interfaces from user and internet-facing networks to limit lateral movement if compromised.

Detection

• Inspect web server and application logs for requests to list_base_config.php with unusual or shell metacharacter-containing template parameters.
• Monitor for unexpected child processes or command execution spawned by the web server process on the gateway.
• Alert on outbound connections from gateway management interfaces to unknown hosts, which may indicate post-exploitation activity.
• Use file integrity monitoring on gateway configuration and system files to detect unauthorized changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.