CVE-2024-51321

HighPublic PoC

Published: 11 March 2025

Published

11 March 2025

Modified

28 May 2025

KEV Added

—

Patch

—

CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

EPSS Score 0.0023 45.5th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-51321 is a high-severity Open Redirect (CWE-601) vulnerability in Zucchetti Ad Hoc Infinity. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Spearphishing Link (T1566.002); ranked at the 45.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).

Deeper analysis

CVE-2024-51321 affects Zucchetti Ad Hoc Infinity 2.4 and stems from an improper check on the m_cURL parameter. This vulnerability, classified as CWE-601 (URL Redirection to Untrusted Site), enables an attacker to redirect a victim to an attacker-controlled website following authentication. It carries a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H), indicating high severity due to its potential for significant integrity and availability impacts.

The attack requires network access, low complexity, low privileges (such as an authenticated account), and user interaction from the victim. An attacker with low privileges can manipulate the m_cURL parameter to trick an authenticated user into being redirected to a malicious site after login, potentially enabling phishing, credential theft, or further exploitation, with low confidentiality impact but high effects on integrity and availability.

Mitigation details are available in the advisory published by BackBox at https://members.backbox.org/zucchetti-ad-hoc-infinity-multiple-vulnerabilities/.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7218

Vulnerability details

In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication.

CWE(s): CWE-601

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1566.002 Spearphishing Link Initial Access

Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

attack.mitre.org →

T1204.001 Malicious Link Execution

An adversary may rely upon a user clicking a malicious link in order to gain execution.

attack.mitre.org →

Why these techniques?

The open redirect vulnerability (CWE-601) directly enables crafting of URLs that redirect authenticated users to attacker-controlled sites, facilitating spearphishing via malicious links (T1566.002) and user execution upon clicking such links (T1204.001) for phishing or credential theft.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0