CVE-2024-0552 is a critical severity (9.8) remote code execution flaw in the web framework of Intumit SmartRobot. An unauthenticated remote attacker can run commands on the server. TWCERT lists SmartRobot v6.0.0-202012tw and earlier as affected and says to move to a later version.
What's affected
- Product: Intumit SmartRobot, the web framework component.
- Affected: v6.0.0-202012tw and earlier, per TWCERT.
- Fixed: any version later than v6.0.0-202012tw. TWCERT names no workaround.
- Weakness: CWE-74, injection.
- Severity: NVD scores it 9.8 (Critical). The record gives no attacker prerequisites.
How to check if you're exposed
- Find the SmartRobot version in the product admin interface or deployment records.
- Confirm whether the service is reachable from the internet through your firewall and reverse proxy rules.
- Review server process and web logs for unexpected commands, new accounts or outbound connections.
Keep a record of what you find. An inventory that lists the product, version and owner turns the next advisory into a lookup instead of a search. Safeguard's dependency scan runs in the browser for the software you build.
What to do now
- Identify every SmartRobot instance.
- Upgrade to a version later than v6.0.0-202012tw, as TWCERT advises.
- Until then, block internet access to the service or place it behind a VPN.
- Check hosts for signs of compromise, since the flaw needs no login.
- Use the Gold directory to track this CVE.
Why it matters
The weakness is CWE-74, improper neutralization of special elements in output used by a downstream component, which covers injection. The record says only that input reaches command execution. It gives no more detail, and I will not add any.
The 9.8 score reflects no login and full impact on confidentiality, integrity and availability. The record has no known exploited flag. With no workaround offered, the upgrade and network isolation are the controls.
Because no login is needed, exposure depends mostly on reachability. An instance that only answers on an internal network is a lower priority than one reachable from the internet, but internal attackers and malware that has already landed on a workstation still count. Patch both, and start with the exposed ones.
Try it yourself
The demo below walks through the same workflow on sample data.
Click through it at your own pace, or open it full screen.
Quick check
Is there a workaround?
The TWCERT page lists none. Its remedy is to upgrade.
Sources
I fetched the TWCERT advisory, which is the source of the version information.
Last reviewed: 19 October 2026.
