CVE-2024-12652

9.3 criticalEPSS 0.8%

Critical (9.3) in intumit smartrobot. EPSS 0.8% chance of exploitation in the next 30 days.

A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2024-12-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

intumit:smartrobot

References

https://zuso.ai/advisory/za-2024-13

Check your stack JSON