CVE-2024-56334: Command Injection in systeminformation

The vulnerability arises from insufficient sanitization of SSIDs before they are passed as parameters to cmd.exe within the getWindowsIEEE8021x function. An attacker who can control the SSID value, either directly or indirectly through a compromised system, can inject malicious commands. Successful exploitation could lead to remote code execution (RCE) or local privilege escalation, depending on the context in which the systeminformation package is used. This could allow an attacker to gain control of the affected system, steal sensitive data, or install malware.

1. Reserved2024-12-19
2. Published2024-12-20
3. Modified2024-12-24
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-56334 is to upgrade to version 5.23.7 or later of the systeminformation package. There are no known workarounds for this vulnerability beyond upgrading. If upgrading is not immediately feasible due to compatibility issues or breaking changes, carefully review all code that utilizes the getWindowsIEEE8021x function and implement strict input validation to sanitize SSIDs before they are passed to cmd.exe. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a crafted SSID containing malicious commands; the command should not be executed.