CVE-2024-5411 is a High severity (CVSS 8.8) authenticated command injection in the web interface of the ORing IAP-420 industrial wireless access point, firmware 2.01e and below. The researcher who reported it listed no solution and no workaround, so the practical defense is to restrict who can reach the management interface.
What's affected
- Product: ORing IAP-420 (also written IAP420), an industrial wireless device sold for settings such as rail, power and factory networks.
- Affected versions: the record says 2.01e and below. The researcher tested on 2.01e.
- Fixed version: none that I could confirm. The CyberDanube advisory lists the solution as none and the workaround as none. Check ORing's support channels for newer firmware before you plan around one.
- Severity: High, CVSS 8.8. The attacker must be logged in to the web interface, but then has high impact on confidentiality, integrity and availability.
- Exploitation: the record's KEV flag is false and the advisory does not report exploitation.
How to check if you're exposed
Find every IAP-420 on your network. Open the device's web interface and read the firmware version from the status page. Anything at 2.01e or older is in scope.
The next question is who can reach the interface. The issue needs a valid session, so exposure depends on both reachability and credential strength. Look for devices that still use factory credentials, and for management pages reachable from broad internal networks or from the internet. A network scan for the web port on your OT address ranges will show which devices answer.
CyberDanube also disclosed a stored cross-site scripting issue, CVE-2024-5410, in the same device in the same advisory. A script planted that way could help an attacker obtain a session, so treat the two together.
What to do now
- Inventory all IAP-420 units and record firmware versions.
- Remove the management interface from any network where it is reachable by people who do not administer the device. CyberDanube's own recommendation is to restrict network access to it.
- Change default and shared passwords and make each administrator account individual.
- Ask ORing support whether newer firmware addresses CVE-2024-5411, and apply it if one exists. The advisory timeline says ORing did not reply to the researcher during disclosure, so expect to chase.
- Add monitoring for configuration uploads and unexpected restarts on these devices.
- Plan replacement if the vendor cannot supply a fix and the device sits on a sensitive segment.
Why it matters
The record maps this to CWE-78, OS command injection. The advisory says a parameter in the configuration file upload is placed into an operating system command without being neutralized. Input meant to be a file name ends up as part of a command the device runs.
Embedded devices make this more serious than the same bug on a web server. They often run as the highest privileged user, rarely get firmware updates, and sit close to control networks. Gaining a shell on the access point can give an attacker a base inside the plant network. The reported disclosure history, with months of silence from the vendor, is a useful signal when you decide how much patch support to expect.
Quick check
Does an attacker need to log in first?
Yes. The record describes authenticated command injection, with low privileges required. Default or weak credentials would remove that barrier in practice.
Is there a patched firmware?
I could not confirm one. The researcher's advisory lists solution and workaround as none. Ask ORing directly and limit access to the management interface in the meantime.
Sources
- CyberDanube advisory: Multiple Vulnerabilities in ORing IAP420
- NVD record data for CVE-2024-5411, as supplied in the batch record
Last reviewed: 19 October 2026.
