CVE-2024-3444 Wangshen SecGate 3600 ?g=net_pro_keyword_import_save unrestricted upload
Remote attackers can upload arbitrary files via the keyword import feature, potentially leading to code execution on the device.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3444?
CVE-2024-3444 is a medium-severity vulnerability in Wangshen SecGate 3600, published on 8 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in Wangshen SecGate 3600 up to 20240408. It has been classified as critical. This affects an unknown part of the file /?g=net_pro_keyword_import_save. The manipulation of the argument reqfile leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259701 was assigned to this vulnerability.
Weakness: CWE-434
Which versions are affected by CVE-2024-3444?
How do I fix CVE-2024-3444?
No fix has been published for CVE-2024-3444 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-3444 being exploited?
There is no known exploitation of CVE-2024-3444 in the wild and no public exploit code.
Sources
Also known as GHSA-gcc4-7369-8cwv.