PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-12700 Tibbo CVE debrief

CVE-2024-12700 is a high-severity unrestricted file upload vulnerability in Tibbo AggreGate Network Manager, published by CISA on December 19, 2024. An authenticated low-privileged user can upload a JSP shell to achieve remote code execution with web server privileges. The vulnerability affects versions 6.34.02 and earlier. CVSS 3.1 score is 8.8 (High). Tibbo has released patched versions 6.40.02 and 6.34.03. Immediate patching is recommended given the low attack complexity and network attack vector.

Vendor
Tibbo
Product
Aggregate Network Manager
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-19
Original CVE updated
2024-12-19
Advisory published
2024-12-19
Advisory updated
2024-12-19

Who should care

Organizations operating Tibbo AggreGate Network Manager for industrial control system (ICS) or operational technology (OT) network management. Security teams responsible for patch management in converged IT/OT environments. Asset owners in critical infrastructure sectors where AggreGate is deployed for device aggregation and monitoring.

Technical summary

The vulnerability exists in the file upload functionality of Tibbo AggreGate Network Manager versions 6.34.02 and earlier. The application fails to properly restrict file types during upload, allowing an authenticated attacker with low privileges to upload a JSP web shell. Once uploaded, the shell can be accessed via HTTP request, executing arbitrary code with the privileges of the web server process. The attack requires network access to the application but no user interaction, with low attack complexity. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network attack vector, low privileges required, and high impact on confidentiality, integrity, and availability.

Defensive priority

high

Recommended defensive actions

  • Update Tibbo AggreGate Network Manager to Version 6.40.02, 6.34.03, or the latest available version per vendor guidance
  • Restrict network access to AggreGate Network Manager management interfaces to trusted administrative hosts only
  • Review and validate file upload restrictions and content-type validation on all web-accessible endpoints
  • Monitor for unexpected JSP file uploads or execution in web application directories
  • Apply defense-in-depth controls including network segmentation for ICS/OT environments per CISA recommended practices

Evidence notes

Vulnerability description and remediation guidance sourced from CISA CSAF advisory ICSA-24-354-05. Affected product versions and patch availability confirmed through vendor remediation statement in source. CVSS vector confirms network attack vector with low privileges required.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-12700 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-12700

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-12700 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-12700

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-354-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-354-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.