CVE-2024-52875

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2024-52875 affects GFI Kerio Control versions 9.2.5 through 9.4.5. The vulnerability stems from improper sanitization of the dest GET parameter supplied to the /nonauth/addCertException.cs, /nonauth/guestConfirm.cs, and /nonauth/expiration.cs endpoints. This parameter is directly incorporated into a Location header within a 302 response, enabling Open Redirect and HTTP Response Splitting attacks that escalate to reflected cross-site scripting; the same flaw can be chained with the product's admin upgrade mechanism to achieve remote command execution.

An unauthenticated remote attacker can supply a crafted dest value to trigger the redirect or header injection. Successful exploitation yields reflected XSS in the context of a victim's browser, which can be leveraged to access the authenticated admin interface and invoke the upgrade feature for arbitrary command execution on the appliance. The issue carries a CVSS 3.1 score of 8.8, reflecting network attack vector, low complexity, no required privileges, and required user interaction.

Public disclosure occurred via a Full Disclosure mailing-list post and a detailed technical write-up at karmainsecurity.com. The EPSS score currently stands at 0.7857 with a recorded peak of 0.8242, indicating sustained exploitation interest following publication. No official patch or mitigation guidance is referenced in the available advisories.