High severity · published Jul 2, 2025
CVE-2024-35164
Apache Guacamole: Improper input validation of console codes
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed
with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Apache Guacamole · Apache Software Foundation
0.8.0 through 1.5.5 · source: vendor
GU
Guacamole · Apache
0.8.0 before 1.6.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35164
Mailing List
https://lists.apache.org/thread/sgs8lplbkrpvd3hrvcnnxh3028h4py70
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/07/01/2
More from Apache Guacamole
7.5
CVE-2018-1340
Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token