CVE-2024-6127
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A path traversal vulnerability in BC Security Empire before version 5.9.3 allows remote code execution. An unauthenticated attacker can exploit this over HTTP by impersonating a normal agent and uploading malicious payload data.
Risk Assessment
The organization risks full system compromise by an unauthenticated attacker, potentially leading to data theft, backdoor installation, or lateral movement within the network.
Recommendation
Immediately update BC Security Empire to version 5.9.3 or later. As a temporary measure, restrict access to the Empire server to trusted networks only.
Original NVD description (English source)
BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path.