In CISA KEV7.2 HighCWE-434
CVE-2024-7694
TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability
TeamT5ThreatSonar Anti-Ransomware
Status
- Exploited in the wild
- In CISA KEV since 17 Feb
- Vendor fix available
Federal deadlineTue 10 Mar, 23:59 UTC
Passed 228 days ago
CISA KEV · added 17 Feb
Exploit probabilityEPSSchecked 25 Oct
1.8%probability of exploitation in the next 30 days
Higher than 78% of scored CVEs
SeverityCVSS
7.2High
Description NVD
ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 4 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 18 Feb · 07:31 UTC | The Hacker News | CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update |
| Wed 18 Feb · 10:46 UTC | SecurityWeek | CISA: Hackers Exploiting Vulnerability in Product of Taiwan Security Firm TeamT5 |
| Wed 18 Feb · 11:51 UTC | Security Affairs | U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalog |
| Tue 24 Feb · 12:11 UTC | SecurityWeek | Chinese APTs exploited CVE-2024-7694 in ThreatSonar security tool |
- Chinese APTs exploited CVE-2024-7694 in ThreatSonar security toolSecurityWeek
- U.S. CISA adds Google Chromium CSS, Microsoft Windows, TeamT5 ThreatSonar Anti-Ransomware, and Zimbra flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- CISA: Hackers Exploiting Vulnerability in Product of Taiwan Security Firm TeamT5SecurityWeek
- CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV UpdateThe Hacker News · first in our coverage · mentions it in passing