CVE-2024-4978
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature.
- Severity
- 8.7 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 26.94%
- Chance of exploitation in the next 30 days. Higher than 98.04% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since May 29, 2024
- Weakness
- CWE-506 Embedded Malicious Code
- Fix
- None yet
- No fixed version published
Description
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 8.7
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- High
- User interaction
- Active
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- High
- Integrity (subsequent systems)
- High
- Availability (subsequent systems)
- High
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 8.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it
- Implementation, Operation: Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| CVE-2026-48027 Compromised Nx Console version 18.95.0 | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2026-8398 A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-g7cv-rxg3-hmpx Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-5mg7-485q-xm76 Two LiteLLM versions published containing credential harvesting malware | Critical | Same weakness, CWE-506 |
| GHSA-69fq-xp46-6x23 Trivy ecosystem supply chain was briefly compromised | Critical Known exploited | Same weakness, CWE-506 |
| CVE-2025-59374 "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced through a supply chain… | Critical Known exploited | Same weakness, CWE-506 |
| GHSA-pxx3-g568-hxr4 color-convert@3.1.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
| GHSA-5fvm-p68v-5wmh color-name@2.0.1 contains malware after npm account takeover | High | Same weakness, CWE-506 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor