CVE-2024-27758

2024-03-1200:00:00

mitre

github.com

rpyc

server method

vulnerability

remote code execution

cve-2024-27758

AI Score

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

total

JSON

In RPyC before 6.0.0, when a server exposes a method that calls the attribute named array for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that results in remote code execution.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:rpyc_project:rpyc:*:*:*:*:*:*:*:*"
    ],
    "vendor": "rpyc_project",
    "product": "rpyc",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "6.0.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]