ExploitCVE-2024-9043
Stack-based Buffer Overflow (CWE-121)
Summary
Secure Email Gateway from Cellopoint has a Buffer Overflow Vulnerability in the authentication process. Remote unauthenticated attackers can send crafted packets to crash the process, thereby bypassing authentication and obtaining system administrator privileges.
Impact
This vulnerability has a severe impact. Attackers can exploit it to bypass authentication and gain system administrator privileges, potentially leading to complete system compromise. The vulnerability affects the confidentiality, integrity, and availability of the system, all rated as HIGH impact. Given the CVSS base score of 9.8 (Critical), this vulnerability poses a significant risk to affected systems.
Exploitation
One proof-of-concept exploit is available on github.com. There is no evidence of proof of exploitation at the moment.
Patch
A patch is not explicitly mentioned in the provided data. However, the vulnerability affects Cellopoint Secure Email Gateway versions 4.2.1 to 4.5.0 (inclusive). Organizations should check for updates beyond version 4.5.0 or contact Cellopoint for patching information.
Mitigation
1. Prioritize patching this vulnerability immediately due to its critical severity (CVSS 9.8) and the availability of a proof-of-concept exploit. 2. If immediate patching is not possible, consider temporarily disabling or isolating affected Secure Email Gateway systems. 3. Implement strong network segmentation to limit potential attacker access to the vulnerable systems. 4. Monitor for unusual authentication attempts or system administrator activities. 5. Keep systems updated to the latest available version, and check regularly for security advisories from Cellopoint. 6. Implement additional layers of authentication and access controls where possible. 7. Conduct a thorough security audit of systems that may have been compromised if the vulnerability was exploited before patching.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
NVD published the first details for CVE-2024-9043
Feedly found the first article mentioning CVE-2024-9043. See article
Feedly estimated the CVSS score as HIGH
EPSS Score was set to: 0.09% (Percentile: 38.4%)
CVE-2024-9043 is a critical vulnerability in Cellopoint's Secure Email Gateway, with a CVSS score of 9.1, that allows remote attackers to exploit a buffer overflow in authentication, potentially crashing the process and gaining admin privileges. The vulnerability has been designated as a Known Exploited Vulnerability (KEV) since September 19, 2024, indicating active exploitation in the wild. No information is provided regarding proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on other third-party vendors or technology. See article