Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that the target must acquire data from a malicious mobile device.
The specific flaw exists within the Android device image acquisition functionality. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23964.
References
| Link | Resource |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-24-1129/ | Third Party Advisory VDB Entry |
| https://docs.magnetforensics.com/docs/axiom/release_notes.html | Release Notes |
Configurations
History
23 Aug 2024, 16:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Magnetforensics
Magnetforensics axiom |
|
| References | () https://www.zerodayinitiative.com/advisories/ZDI-24-1129/ - Third Party Advisory, VDB Entry | |
| References | () https://docs.magnetforensics.com/docs/axiom/release_notes.html - Release Notes | |
| CPE | cpe:2.3:a:magnetforensics:axiom:8.0.0.39753:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
21 Aug 2024, 17:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-08-21 17:15
Updated : 2024-08-23 16:54
NVD link : CVE-2024-7448
Mitre link : CVE-2024-7448
JSON object : View
Products Affected
magnetforensics
- axiom
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')