Read the docs
TI-2024-11737 Aliases CVE-2024-12652GHSA-jfx8-86f7-x4h2

Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')

Priority MEDIUM 47CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A Improper Control of Generation of Code ('Code Injection') vulnerability in groovy script function in SmartRobot′s Conversational AI Platform before v7.2.0 allows remote authenticated users to perform arbitrary system commands via Groovy code.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00779 56th percentileScored 2026-11-07
Fix Fixed SmartRobot′s Conversational AI Platform (Intumit): v7.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
INTUMITSmartRobot′s Conversational AI Platformbefore v7.2.0v7.2.0Patch availableCNA
  • SmartRobot′s Conversational AI Platform VendorINTUMIT Affected before v7.2.0 Fixed in v7.2.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:*before 7.2.0VulnerableINTUMIT
  • cpe:2.3:a:intumit:smartrobot:*:*:*:*:*:*:*:* Versions before 7.2.0 Vulnerable ·INTUMIT

Remediation

  • Fix · CNA SmartRobot′s Conversational AI Platform (Intumit) Fixed in v7.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12652
  2. 2026-10-03 Alias added: GHSA-jfx8-86f7-x4h2

References

Advisory 1

  • TI-2024-02241 Intumit SmartRobot - Use of Hard-coded Cryptographic Key CVSS 3.1CRITICAL 9.8
  • TI-2024-00510 Intumit inc. SmartRobot - Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-03141 INTUMIT SmartRobot - Server-Side Request Forgery CVSS 3.1HIGH 7.5
  • TI-2024-08142 INTUMIT SmartRobot - Cross-site Scripting CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences