Cyber Resilience

CVE-2024-55529

CriticalRCE

Published: 06 January 2025

Published
06 January 2025
Modified
05 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0126 79.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55529 is a critical-severity Code Injection (CWE-94) vulnerability in Zblogcn Z-Blogphp. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 20.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

Z-BlogPHP 1.7.3 is affected by CVE-2024-55529, a critical arbitrary code execution vulnerability (CVSS 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) published on 2025-01-06. The issue arises in the \zb_users\theme\shell\template component and is classified under CWE-94 (Code Injection).

Remote unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction required. Successful exploitation enables arbitrary code execution on the target system, granting high-impact control over confidentiality, integrity, and availability.

Advisories and further details are available at https://github.com/fengyijiu520/Z-Blog-.

EU & UK References

Vulnerability details

Z-BlogPHP 1.7.3 is vulnerable to arbitrary code execution via \zb_users\theme\shell\template.

CWE(s)
CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated code injection (CWE-94) in public-facing Z-BlogPHP web app directly enables exploitation of public-facing applications for arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-13773Shared CWE-94
CVE-2025-50692Shared CWE-94
CVE-2026-30643Shared CWE-94
CVE-2026-30460Shared CWE-94
CVE-2025-71243Shared CWE-94
CVE-2026-44262Shared CWE-94
CVE-2024-13792Shared CWE-94
CVE-2020-37052Shared CWE-94
CVE-2026-42555Shared CWE-94
CVE-2025-65037Shared CWE-94

Affected Assets

zblogcn
z-blogphp
1.7.3

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the arbitrary code execution vulnerability by requiring timely identification, reporting, and patching of the specific flaw in Z-BlogPHP's theme shell template component.

SI-10 Information Input Validation good match
prevent

Prevents code injection attacks like this CVE by enforcing validation of inputs to the vulnerable zb_users/theme/shell/template path.

CM-7 Least Functionality partial match
prevent

Reduces the attack surface by configuring the system to disable or restrict unnecessary functionality such as exploitable theme shell templates.

References