CVE-2024-52875 Open redirect in Kerio Control
Attackers can exploit unsanitized parameters to redirect users or inject scripts, potentially leading to remote code execution via the admin interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-52875?
CVE-2024-52875 is a high-severity vulnerability in GFI Kerio Control, published on 31 Jan 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
Weakness: CWE-113
Which versions are affected by CVE-2024-52875?
It affects 1 product.
Products include Gfi Kerio Control.
How do I fix CVE-2024-52875?
No fix has been published for CVE-2024-52875 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-52875 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52875 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in GFI Kerio Control
- CVE-2025-34070 GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces
- CVE-2025-34069 GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding
- CVE-2025-34071 GFI Kerio Control Unsigned System Image Upload Root Code Execution
- CVE-2019-16414 Cross-site scripting in n/a
Sources
Also known as GHSA-wwwq-jmfm-4f5c.