CVE-2024-41954 FOG Weak file permissions
Local attackers can read plaintext service account credentials from a world-readable file to create new web application accounts and escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-41954?
CVE-2024-41954 is a medium-severity vulnerability in fogproject, published on 31 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
FOG is a cloning/imaging/rescue suite/inventory management system. The application stores plaintext service account credentials in the "/opt/fog/.fogsettings" file. This file is by default readable by all users on the host. By exploiting these credentials, a malicious user could create new accounts for the web application and much more. The vulnerability is fixed in 1.5.10.41.
Weakness: CWE-732
Which versions are affected by CVE-2024-41954?
It affects 1 product.
Products include Fogproject Fogproject.
How do I fix CVE-2024-41954?
No fix has been published for CVE-2024-41954 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-41954 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-41954 exists.
Other vulnerabilities in fogproject
- CVE-2025-58443 FOG's authentication bypass leads to full SQL DB dump
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-42348 FOG leaks sensitive information (AD domain, username and password)
- CVE-2024-40645 FOG Authenticated File Upload RCE
- CVE-2021-32243 File upload in n/a
Sources
Also known as GHSA-pcqm-h8cx-282c.