# CVE-2024-9916: HuangDou UTCMS cli.php os command injection

- Exploited (CISA KEV): no
- Published: 2024-10-13
- CVSS: 6.9 MEDIUM (v4.0)
- EPSS: 73.6% (99th percentile)
- CWE: CWE-78

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Before feed history | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-08-15 | 306 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### F5

- 2025-08-15 · new · rule 200103647
  > Added: signature 200103647 "HuangDou UTCMS V9 OS Command Injection" (Command Execution, risk High), systems: Other Web Server. References: CVE-2024-9916.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2024-9916, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2024-9916, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-9916 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-9916