CVE-2024-4297: HGiga iSherlock - Arbitrary File Download

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-29 · updated 2026-06-17
Weakness: CWE-22

Description

The system configuration interface of HGiga iSherlock (including MailSherlock, SpamSherlock, AuditSherlock) fails to filter special characters in certain function parameters, allowing remote attackers with administrative privileges to exploit this vulnerability to download arbitrary system files.

Affected products

HGiga Isherlock: from 4.5 before 4.5-147; from 5.5 before 5.5-147 — fixed in 4.5-147, 5.5-147

How to fix

Upgrade to a fixed version: HGiga Isherlock 4.5-147, 5.5-147. Check the vendor advisory for mitigations.

References

https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html
https://www.twcert.org.tw/tw/cp-132-7767-ce3b4-1.html

Get alerted when CVE-2024-4297 or the next vulnerability affects your stack