CVE-2024-2352 is a medium severity (6.3) command injection in 1Panel up to 1.10.1-lts, in the device swap update API. A fix pull request is linked from the record. Upgrade past 1.10.1-lts and limit who can reach the panel. NVD published it on 2024-03-10.
Weakness: CWE-77 (Command Injection).
What's affected
- Affected: 1Panel (Fit2Cloud) up to 1.10.1-lts.
- Fixed: the record says to apply a patch and links a pull request, but names no release number. Check the 1Panel release notes for the first build that includes pull request 4131.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, network reachable with a low-privilege account.
The record places the flaw in the function baseApi.UpdateDeviceSwap, at /api/v1/toolbox/device/update/swap, through the Path argument. It says the exploit has been disclosed to the public.
How to check if you're exposed
1Panel is a server management panel, so check the installed version.
- Run
1pctl versionon the host, or read the version shown in the panel footer or settings. - Confirm whether the panel port is reachable from the internet.
- Review which accounts exist in the panel and remove ones you do not need.
What to do now
- Upgrade 1Panel to the latest release and confirm in its notes that pull request 4131 is included.
- Restrict panel access to a VPN or an IP allow list, and do not expose it on the open internet.
- Review panel accounts and remove unused ones, since the flaw needs a login.
- Review the swap setting and system files on the host for unexpected changes.
- Add 1Panel to your inventory with its version, and subscribe to its release announcements.
- If the panel runs on a shared host, consider whether other administrators need to be told about the exposure window.
Why it matters
The record classes this as CWE-77 (Command Injection). A value that should be a file path is passed into a shell command without enough cleaning, so extra text can be run as a second command. Panels that manage a server run as a powerful account, so a low-privilege flaw in them is worth treating seriously.
NVD scored it 6.3 (Medium). The KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
The record links a fix pull request but names no release. Check the 1Panel release notes.
Does it need a login?
Yes. The vector lists low privileges required.
Sources
- CVE-2024-2352 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2352, as held in the batch record
- 1Panel pull request 4131
Last reviewed: 19 October 2026.
