CVE-2024-35164
published 2025-07-02CVE-2024-35164: The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If…
PriorityP350high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.42%
34.3th percentile
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed
with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | guacamole | — | — |
| apache | guacamole | >= 0.8.0 < 1.6.0 | 1.6.0 |
| apache_software_foundation | apache_guacamole | 0.8.0 – 1.5.5 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
vendor_apache6.8MEDIUM
vendor_oracle6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Guacamole) — CVE-2024-35164
vendor_oracle·2025-10-15·CVSS 6.6
CVE-2024-35164 [MEDIUM] Oracle Oracle Communications Applications Risk Matrix: Core (Apache Guacamole) — CVE-2024-35164
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Guacamole) vulnerability
CVE: CVE-2024-35164
CVSS: 6.6
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Apache
Apache guacamole: CVE-2024-35164
vendor_apache·CVSS 6.8
CVE-2024-35164 [MEDIUM] Apache guacamole: CVE-2024-35164
Apache guacamole: CVE-2024-35164
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Acknowledgements: We would like to thank Tizian Seehaus (Tibotix) for reporting this issue.
OSV
CVE-2024-35164: The terminal emulator of Apache Guacamole 1
osv·2025-07-02·CVSS 7.5
CVE-2024-35164 [HIGH] CVE-2024-35164: The terminal emulator of Apache Guacamole 1
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.6.0, which fixes this issue.
GHSA
GHSA-8wh3-jcvc-qrmq: The terminal emulator of Apache Guacamole 1
ghsa_unreviewed·2025-07-02
CVE-2024-35164 [MEDIUM] CWE-129 GHSA-8wh3-jcvc-qrmq: The terminal emulator of Apache Guacamole 1
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed
with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-07-02
Published