CVE-2024-7576
published 2024-09-25CVE-2024-7576: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
PriorityP181critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.45%
35.9th percentile
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| progress_software | telerik_ui_for_wpf | >= 2011.1.315 < 2024.3.924 | 2024.3.924 |
| telerik | ui_for_wpf | < 2024.3.924 | 2024.3.924 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3x94-47mg-35rf: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024
ghsa_unreviewed·2024-09-25
CVE-2024-7576 [HIGH] CWE-502 GHSA-3x94-47mg-35rf: In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
VulnCheck
Progress ui_for_wpf Deserialization of Untrusted Data
vulncheck·2024·CVSS 7.8
CVE-2024-7576 [HIGH] Progress ui_for_wpf Deserialization of Untrusted Data
Progress ui_for_wpf Deserialization of Untrusted Data
In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.
Affected: Progress ui_for_wpf
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://cyble.com/blog/cyble-honeypot-sensors-detect-d-link-cisco-qnap-and-linux-attacks/
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-09-25
Published
Exploited in the wild