CVE-2024-23749

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-02-09 · updated 2026-06-17
Weakness: CWE-77

Description

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.

Affected products

9Bis Kitty: through 0.76.1.13

References

http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html
http://seclists.org/fulldisclosure/2024/Feb/13
http://seclists.org/fulldisclosure/2024/Feb/14
https://blog.defcesco.io/CVE-2024-23749
http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html
http://seclists.org/fulldisclosure/2024/Feb/13
http://seclists.org/fulldisclosure/2024/Feb/14
https://blog.defcesco.io/CVE-2024-23749

Get alerted when CVE-2024-23749 or the next vulnerability affects your stack