CVE-2024-25004

Published: Feb 9, 2024Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.

Affected (1)

Products: 9bis: Kitty

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
9bis Kitty	Up to 0.76.1.13

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (10)

http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2024/Feb/13

Source: cve@mitre.org

ExploitMailing List

http://seclists.org/fulldisclosure/2024/Feb/14

Source: cve@mitre.org

ExploitMailing List

https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004

Source: cve@mitre.org

ExploitThird Party Advisory

http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2024/Feb/13

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing List

http://seclists.org/fulldisclosure/2024/Feb/14

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing List

https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.