CVE-2024-50960
📋 TL;DR
A command injection vulnerability in the Nmap diagnostic tool within Extron SMP/SME admin web consoles allows authenticated attackers to execute arbitrary commands as root. This affects Extron SMP 111, SMP 351, SMP 352, and SME 211 devices running vulnerable firmware versions. Attackers can gain complete control of affected devices.
💻 Affected Systems
- Extron SMP 111
- Extron SMP 351
- Extron SMP 352
- Extron SME 211
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to install persistent backdoors, pivot to internal networks, exfiltrate sensitive data, or disrupt critical AV operations.
Likely Case
Attackers gain root shell access to manipulate device configurations, install cryptocurrency miners, or use devices as network pivots for lateral movement.
If Mitigated
Limited to authenticated users only, but still provides root access if credentials are compromised or insider threat exists.
🎯 Exploit Status
Public exploit code available. Requires valid admin credentials. Simple command injection via Nmap parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Extron website for latest firmware updates
Vendor Advisory: https://www.extron.com/article/smp
Restart Required: Yes
Instructions:
1. Download latest firmware from Extron website. 2. Log into admin web console. 3. Navigate to System > Update. 4. Upload firmware file. 5. Apply update and restart device.
🔧 Temporary Workarounds
Disable Nmap Diagnostic Tool
linuxRemove or restrict access to the vulnerable Nmap diagnostic feature
# Requires modifying web interface configuration files
# Exact commands depend on device model and firmware
Network Segmentation
allIsolate Extron devices on separate VLAN with strict firewall rules
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Extron devices from critical networks
- Enforce strong authentication policies and monitor for credential compromise
- Disable admin web console access from untrusted networks
- Implement application firewall rules to block suspicious Nmap parameter patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version in admin web console under System > Information. Compare against affected versions.Check Version:
# Log into admin web interface and navigate to System > Information pageVerify Fix Applied:
Verify firmware version is above vulnerable versions. Test Nmap diagnostic tool with safe parameters to confirm sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual Nmap diagnostic tool usage with suspicious parameters
- Multiple failed authentication attempts followed by Nmap usage
- Commands with shell metacharacters in web logs
Network Indicators:
- Unexpected outbound connections from Extron devices
- Traffic patterns suggesting command-and-control communication
- Port scans originating from Extron devices
SIEM Query:
source="extron-web-logs" AND (uri="*/nmap*" AND (param="*;*" OR param="*|*" OR param="*`*" OR param="*$(*"))