CVE-2024-11013: nec corporation univerge ix Command Injection
Vulnerability summary
CVE-2024-11013 is a high (CVSS 7.2) Command Injection vulnerability in nec corporation univerge ix. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.4% of scored vulnerabilities.
Timeline
- 29-11-2024PublishedVulnerability first disclosed.
- 24-07-2025Last modifiedVulnerability information updated.
Description
Command Injection vulnerability in NEC Corporation UNIVERGE IX from Ver9.2 to Ver10.10.21, for Ver10.8 up to Ver10.8.27, for Ver10.9 up to Ver10.9.14 and UNIVERGE IX-R/IX-V Ver1.2.15 and earlier allows a attacker to inject an arbitrary CLI commands to be executed on the device via the management interface.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.10% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Nec corporation2 products
- univerge ixfrom Ver9.2 to Ver10.10.21 | for Ver10.8 up to Ver10.8.27 | for Ver10.9 up to Ver10.9.14
- univerge ix-r/ix-vVer1.2.15 and earlier
1 vendor · 2 products