CVE-2024-25089

Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes

Critical · published February 4, 2024

CVSS v3.1
9.8
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

🚨 A remote attacker can waltz right in and execute arbitrary code through a simple gRPC call — that’s a ticket to total mayhem! 🔥 Think of it like a hotel room where the front desk gives out master keys to anyone who asks, allowing them to sneak into any room without a trace. With this vulnerability, an attacker can exploit the Windows Firewall Control without breaking a sweat. If left unpatched, an attacker could take control of the system, potentially leading to data breaches, corrupted files, or even complete system compromise. It’s like handing the keys to your digital kingdom to someone you don’t trust. You definitely don’t want this to turn into a catastrophic security breach!

Put simply

Think of it like a hotel room where the front desk gives out master keys to anyone who asks, allowing them to sneak into any room without a trace. With this vulnerability, an attacker can exploit the Windows Firewall Control without breaking a sweat. This vulnerability exists in Malwarebytes Binisoft Windows Firewall Control versions before 6.9.9.2, where an improper validation in gRPC named pipes allows for arbitrary code execution by remote attackers.

What to do

If left unpatched, an attacker could take control of the system, potentially leading to data breaches, corrupted files, or even complete system compromise. It’s like handing the keys to your digital kingdom to someone you don’t trust. You definitely don’t want this to turn into a catastrophic security breach! Immediately update your Malwarebytes Binisoft Windows Firewall Control to version 6.9.9.2 or later. Additionally, consider reviewing your network permissions to limit access to gRPC services! This is fixable! Act quickly, and you’ll keep your defenses strong! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01796 · 78.3th percentile
Published
2024-02-04T00:00Z
EPSS history
Timeline
  • 04 FEB 00:00Z
    Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes
    cvelistv5