Windows SDP Client vulnerable to Improper Input Validation and OS Command Injection
CVE-2024-6973

8.8HIGH

Key Information:

Vendor

Cato Networks

Status
Sdp Client
Vendor
CVE Published:
31 July 2024

What is CVE-2024-6973?

A vulnerability exists in the Cato Networks Windows SDP client that allows an attacker to execute arbitrary code on a vulnerable system. This occurs through the manipulation of crafted URLs, which can exploit the software if it is running on versions prior to 5.10.34. Users are advised to update their software to mitigate the risk of unauthorized code execution resulting from this security issue.

Affected Version(s)

SDP Client Windows 0 < 5.10.34

References

https://support.catonetworks.com/hc/en-us/articles/197569...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

AmberWolf
.