CVE-2024-40895: FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS…

Description

FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the executable file path is set to a batch file (.bat) or command file (.cmd) extension.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Attack vector

Network

Complexity

High

Privileges

None

User interaction

Required

Confidentiality

Low

Integrity

High

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 40% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EP

EDR Plus Pack · Sky Co., Ltd.

Bundled FFRI AMC versions 3.4.0 to 3.5.3 · source: vendor, CISA

FA

FFRI AMC · FFRI Security, Inc.

3.4.0 to 3.5.3 · source: vendor, CISA

FA

FFRI AMC for ActSecure χ · NEC Corporation

3.4.0 to 3.5.3 · source: vendor

EP

Edr Plus Pack Cloud · Skygroup

3.4.0 before 3.5.3 · source: CISA