Cyber Resilience

CVE-2024-22515

High

Published: 06 February 2024

Published
06 February 2024
Modified
08 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1373 94.4th percentile
Risk Priority 26 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-22515 is a high-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Ispyconnect Agent Dvr. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-22515 is an unrestricted file upload vulnerability, tracked as CWE-434, that affects iSpyConnect.com Agent DVR version 5.1.6.0. The flaw exists in the upload audio component and allows arbitrary files to be uploaded to the server.

An authenticated attacker with network access and low privileges can exploit the issue without user interaction. Successful exploitation can result in full impact to confidentiality, integrity, and availability, consistent with the CVSS 8.8 rating.

Public references consist of a GitHub repository containing proof-of-concept material for the upload vector. The associated EPSS score has remained flat at 0.1373 with no material rise after disclosure.

EU & UK References

Vulnerability details

Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component.

CWE(s)
CWE-434

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1105 Ingress Tool Transfer Command And Control
Adversaries may transfer tools or other files from an external system into a compromised environment.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Unrestricted file upload via the audio component enables ingress tool transfer (T1105) by allowing arbitrary files and represents exploitation of a public-facing application vulnerability (T1190).

Affected Assets

ispyconnect
agent dvr
5.1.6.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

MP-7 Media Use
addresses: CWE-434

Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.

SC-44 Detonation Chambers
addresses: CWE-434

Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.

SC-51 Hardware-based Protection
addresses: CWE-434

Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.

SI-3 Malicious Code Protection
addresses: CWE-434

Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

References