Low Privileged Attack Can Trigger Execution of Arbitrary OS Commands as Root in mGuard Devices

CVE-2024-43386

Summary

This vulnerability arises from improper handling of special elements within the EMAIL_NOTIFICATION.TO variable in VDE's mGuard devices. A low privileged remote attacker may exploit this flaw to execute arbitrary operating system commands with root privileges. Such exploitation can compromise the integrity, availability, and confidentiality of the device, presenting significant security risks to affected systems and their environments.

References