CVE-2024-5718

HIGH

Logsign Unified SecOps Platform 6.4.6-6.4.7 - Unauthenticated Remote Code Execution via Cluster HTTP API

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-5718. PoCs published by byjanke.

AI-analyzed exploit summary This repository contains functional exploit code for CVE-2024-5716 (authentication bypass) and CVE-2024-5717 (command injection) in Logsign Unified SecOps Platform. The exploit chains these vulnerabilities to achieve unauthenticated remote code execution.

Description

Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 by default when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24166.

Exploits (1)

github WORKING POC 2 stars

by byjanke · pythonpoc

https://github.com/byjanke/logsign-rce

View Code ZIP pw:eip

This repository contains functional exploit code for CVE-2024-5716 (authentication bypass) and CVE-2024-5717 (command injection) in Logsign Unified SecOps Platform. The exploit chains these vulnerabilities to achieve unauthenticated remote code execution.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Logsign Unified SecOps Platform

No auth needed

Prerequisites: network access to target · target running vulnerable Logsign version

MITRE ATT&CK

T1190 - Exploit Public-Facing Application T1059 - Command and Scripting Interpreter T1203 - Exploitation for Client Execution

devstral-2 · analyzed Jun 13, 2026 Full analysis →

References (2)

Core 2

Core References

Third Party Advisory x_research-advisory

https://www.zerodayinitiative.com/advisories/ZDI-24-618/

Release Notes vendor-advisory

https://support.logsign.net/hc/en-us/articles/19316621924754-03-06-2024-Version-6-4-8-Release-Notes

Scores

CVSS v3 8.1

EPSS 0.0144

EPSS Percentile 69.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-306

Status published

Products (1)

logsign/unified_secops_platform 6.4.6 - 6.4.8

Published Nov 22, 2024

Tracked Since Feb 18, 2026