PT-2025-16806 · Lrqa Nettitude · Lrqa Nettitude Poshc2

Published 2025-04-16 · Updated 2025-04-20 · CVE-2024-53303

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LRQA Nettitude PoshC2 versions after commit 123db87

Description A remote code execution issue exists in the upload file function, allowing authenticated attackers to execute arbitrary code via a crafted POST request to the API endpoint. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided.

Recommendations For versions after commit 123db87, consider disabling the upload file function until a patch is available to prevent exploitation. Restrict access to the vulnerable function to minimize the risk of arbitrary code execution. Avoid using the vulnerable upload file function in the affected API endpoint until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-53303

Affected Products

Lrqa Nettitude Poshc2

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-53303 · Security Note
• https://gist.github.com/fern89/3464e8428d7675e4f0f390a6b2b2842e · Note
• https://twitter.com/CVEnew/status/1913823757287797146 · Twitter Post