CVE-2024-9150 Code Injection in Wyn Enterprise
Attackers with low privileges can execute malicious code and OS commands via report generation, leading to high-privilege system compromise.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-9150?
CVE-2024-9150 is a high-severity code injection vulnerability in Wyn Enterprise, published on 21 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a host system with applications high privileges. This issue has been fixed in version 8.0.00204.0
Weakness: CWE-1336
Which versions are affected by CVE-2024-9150?
How do I fix CVE-2024-9150?
No fix has been published for CVE-2024-9150 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-9150 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-9150 exists.
Sources
Also known as GHSA-qf7q-96xw-2xgh.