CVE-2024-35164CWE-129

Apache Guacamole: Improper input validation of console codes

Medium · published July 2, 2025

CVSS v3.1
6.8
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed

with the privileges of the running guacd process.

Users are recommended to upgrade to version 1.6.0, which fixes this issue.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00517 · 43.1th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2025-07-02T11:23Z
EPSS history
Timeline
  • 02 JUL 11:23Z
    Apache Guacamole: Improper input validation of console codes
    cvelistv5