CVE-2024-40895 Command injection in EDR Plus Pack
Remote attackers can execute arbitrary OS commands in FFRI AMC if notification settings use batch files, requiring specific configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-40895?
CVE-2024-40895 is a medium-severity command injection vulnerability in FFRI Security, Inc. EDR Plus Pack, published on 30 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension.
Weakness: CWE-78
Which versions are affected by CVE-2024-40895?
How do I fix CVE-2024-40895?
No fix has been published for CVE-2024-40895 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-40895 being exploited?
There is no known exploitation of CVE-2024-40895 in the wild and no public exploit code.
Sources
Also known as GHSA-3cmr-mvgm-pmfq.