CVE-2024-36075: Code Injection
The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due to the way an archive obtained from the Endpoint Protector or Unify server is extracted on the endpoint. An attacker who is able to modify the archive on the server could obtain remote code execution as an administrator on an endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36075?
CVE-2024-36075 is categorized as a critical severity vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2024-36075?
To remediate CVE-2024-36075, update CoSoSys Endpoint Protector to version 5.9.4 or later, and Unify agent to version 7.0.7 or later.
What types of attacks can CVE-2024-36075 facilitate?
CVE-2024-36075 can enable attackers to execute arbitrary code on affected systems by exploiting the vulnerability during archive extraction.
Which software versions are affected by CVE-2024-36075?
CVE-2024-36075 affects CoSoSys Endpoint Protector versions up to 5.9.3 and Unify agent versions up to 7.0.6.
Are there any workarounds for CVE-2024-36075?
Currently, the best approach to mitigate CVE-2024-36075 is to apply the necessary software updates, as no alternative workarounds have been published.