CVE-2024-6977: medium-severity vulnerability in Cato Networks SDP Client
Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeover
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack requires bypassing protections on modifying the tunnel token on a the attacker's system.This issue affects SDP Client: before 5.10.34.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
Cato Networks · SDP ClientRelated CVEs — Cato Networks SDP Client
In the same product, most dangerous first.
CVE-2024-6973HIGHRemote Code Execution in Cato Windows SDP client via crafted URLsEPSS 0.8%CVE-2024-6975HIGHCato Networks Windows SDP Client Local Privilege Escalation via openssl configuration fileEPSS 0.3%CVE-2025-3886MEDIUMCatoNetworks CatoClient up to 5.8 PrivilegedHelperTool Race ConditionEPSS 0.3%CVE-2024-6974HIGHCato Networks Windows SDP Client Local Privilege Escalation via self-upgradeEPSS 0.2%CVE-2024-6978MEDIUMCato Networks Windows SDP Client Local root certificates can be installed by low-privileged usersEPSS 0.1%CVE-2026-10739HIGHCato Networks SDP Client for Windows is vulnerable to Local Privilege EscalationEPSS 0.1%