cbcvebase.
CVE-2024-26234
published 2024-04-09

CVE-2024-26234: Proxy Driver Spoofing Vulnerability Proxy Driver Spoofing Vulnerability

medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
4.85%
90.9th percentile
Proxy Driver Spoofing Vulnerability Proxy Driver Spoofing Vulnerability

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_version_1507>= 10.0.10240.0 < 10.0.10240.2059610.0.10240.20596
microsoftwindows_10_version_1607>= 10.0.14393.0 < 10.0.14393.689710.0.14393.6897
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.569610.0.17763.5696
microsoftwindows_10_version_1809>= 10.0.17763.0 < 10.0.17763.569610.0.17763.5696
microsoftwindows_10_version_21h2>= 10.0.19043.0 < 10.0.19044.429110.0.19044.4291
microsoftwindows_10_version_22h2>= 10.0.19045.0 < 10.0.19045.429110.0.19045.4291
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.289910.0.22000.2899
microsoftwindows_11_version_22h2>= 10.0.22621.0 < 10.0.22621.344710.0.22621.3447
microsoftwindows_11_version_22h3>= 10.0.22631.0 < 10.0.22631.344710.0.22631.3447
microsoftwindows_11_version_23h2>= 10.0.22631.0 < 10.0.22631.344710.0.22631.3447
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.7601.0 < 6.1.7601.270676.1.7601.27067
microsoftwindows_server_2008_service_pack_2>= 6.0.6003.0 < 6.0.6003.226186.0.6003.22618
microsoftwindows_server_2012>= 6.2.9200.0 < 6.2.9200.248216.2.9200.24821
microsoftwindows_server_2012_r2>= 6.3.9600.0 < 6.3.9600.219246.3.9600.21924
microsoftwindows_server_2016>= 10.0.14393.0 < 10.0.14393.689710.0.14393.6897
microsoftwindows_server_2019>= 10.0.17763.0 < 10.0.17763.569610.0.17763.5696
microsoftwindows_server_2022>= 10.0.20348.0 < 10.0.20348.240210.0.20348.2402
msrcwindows_10
msrcwindows_10_version_1607
msrcwindows_10_version_1809
msrcwindows_10_version_21h2
msrcwindows_10_version_22h2
msrcwindows_11_version_21h2
msrcwindows_11_version_22h2
msrcwindows_11_version_23h2

Detection & IOCsextracted from sources · hover to see the quote

filenameCatalog Authentication Client Service
  • Look for a malicious Windows driver signed with a valid Microsoft Hardware Publisher Certificate impersonating Thales Group, labeled 'Catalog Authentication Client Service' by 'Catalog Thales'.
  • The malicious driver was previously bundled with a marketing software called 'LaiXi Android Screen Mirroring' — flag installations or drivers associated with this software.
  • The file functions as a malicious backdoor; treat any driver signed by 'Catalog Thales' as highly suspicious and check against Microsoft's updated revocation list.
  • CVE-2024-26234 is confirmed exploited in the wild and publicly disclosed; prioritize detection on all Windows endpoints listed as affected.
  • Microsoft has added the malicious files to its driver revocation list as part of the April 2024 Patch Tuesday cycle; verify revocation list is applied on all endpoints.
  • ·Sophos could not independently verify the legitimacy of the LaiXi Android Screen Mirroring software itself, only that the bundled driver is malicious.
  • ·Microsoft initially failed to tag CVE-2024-26234 as a zero-day/exploited vulnerability; the advisory was updated post-release to reflect active exploitation.

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
cvelistv56.7MEDIUM
vulncheck6.7MEDIUM
vendor_msrc6.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.