CVE-2024-1651criticalCWE-502

Torrentpier 2.4.1 - RCE

60Vexday Risk Score

Keep watching. It has a public proof of concept.

ssvc Attendcvss 10epss 34%

from disclosure to weapon4 days

Published on NVDFeb 19

1st PoC+4d

exploitation probability

34%top 2% of all CVEs

observed exploitation

nono source reports it

4 public exploit(s)

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Torrentpier · Torrentpier

public PoCs found — 4

githubgithub.com/sharpicx/CVE-2024-1651-PoC★ 15 githubgithub.com/hy011121/CVE-2024-1651-exploit-RCE★ 3 githubgithub.com/Whiteh4tWolf/CVE-2024-1651-PoC★ 0 githubgithub.com/killukeren/cve-2024-1651★ 0

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://fluidattacks.com/advisories/xavi/https://github.com/torrentpier/torrentpier