CVE-2024-25249 Code injection in n/a
Remote attackers can execute arbitrary code in He3 App for macOS by exploiting RunAsNode and enableNodeClilnspectArguments settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-25249?
CVE-2024-25249 is a critical code injection vulnerability in n/a, published on 21 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
Weakness: CWE-94
Which versions are affected by CVE-2024-25249?
It affects 1 product.
Products include He3app He3 App.
How do I fix CVE-2024-25249?
No fix has been published for CVE-2024-25249 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-25249 being exploited?
There is no known exploitation of CVE-2024-25249 in the wild and no public exploit code.
Sources
Also known as GHSA-cgpg-xpvx-xqxj.