CVE-2024-39844

2024-07-0317:15:04

Debian Security Bug Tracker

security-tracker.debian.org

znc security

modtcl vulnerability

remote code execution

kick vulnerability

unix platform

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

Low

EPSS

Percentile

15.8%

JSON

In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK.

OSVersionArchitecturePackageVersionFilename
Debian12allznc< 1.8.2-3.1+deb12u1znc_1.8.2-3.1+deb12u1_all.deb
Debian11allznc< 1.8.2-2+deb11u1znc_1.8.2-2+deb11u1_all.deb
Debian999allznc< 1.9.1-1znc_1.9.1-1_all.deb
Debian13allznc< 1.9.1-1znc_1.9.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	znc	< 1.8.2-3.1+deb12u1	znc_1.8.2-3.1+deb12u1_all.deb
Debian	11	all	znc	< 1.8.2-2+deb11u1	znc_1.8.2-2+deb11u1_all.deb
Debian	999	all	znc	< 1.9.1-1	znc_1.9.1-1_all.deb
Debian	13	all	znc	< 1.9.1-1	znc_1.9.1-1_all.deb