CVE-2024-7448 — HIGH (8.0) — White Hats Nepal

Vulnerability Description

Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device. The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23964.

CVSS Score

8.0

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Magnetforensics	Axiom	8.0.0.39753

Related Weaknesses (CWE)

CWE-78

References

https://docs.magnetforensics.com/docs/axiom/release_notes.htmlRelease Notes
https://www.zerodayinitiative.com/advisories/ZDI-24-1129/Third Party AdvisoryVDB Entry

FAQ

What is CVE-2024-7448?

CVE-2024-7448 is a vulnerability with a CVSS score of 8.0 (HIGH). Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensi...

How severe is CVE-2024-7448?

CVE-2024-7448 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-7448?

Check the references section above for vendor advisories and patch information. Affected products include: Magnetforensics Axiom.