CVE-2024-12828

⚠️ high

Summary

Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. W

Description

Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability.

The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.

CVSS Score

8.8

High

EPSS Score

21.7

Exploit Probability

Published Date

2024-12-30

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is High Risk - more severe than 81.1% of all 330,193 vulnerabilities in our database.

#62,466

Top 25% most severe

Severity Percentile

🎯 CISA SSVC Assessment Updated: Dec 30, 2024

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-08-14

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE IDs (Weakness Types)

CWE-78

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-22678	🔶 medium	5.4	0.0	Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the ...	2026-05-21
CVE-2025-67738	⚠️ high	8.5	0.1	squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module a...	2025-12-11
CVE-2025-61541	⚠️ high	7.1	0.1	Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi). The reset l...	2025-10-16
CVE-2024-45692	⚠️ high	7.5	0.1	Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.	2024-09-04
CVE-2024-36450	🔶 medium	5.4	0.2	Cross-site scripting vulnerability exists in sysinfo.cgi of Webmin versions prior to 1.910. If this vulnerability is exp...	2024-07-10
CVE-2024-36451	⚠️ high	8.8	0.2	Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2...	2024-07-10

CVE-2024-12828

Summary

Description

📊 Relative Risk Intelligence

🎯 CISA SSVC Assessment Updated: Dec 30, 2024

📦 Affected Products 1

🔗 References 2

🔗 Related CVEs 6