High severity8.8NVD Advisory· Published Jan 31, 2025· Updated Jun 17, 2026
CVE-2024-52875
CVE-2024-52875
Description
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gfi:kerio_control:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:gfi:kerio_control:*:*:*:*:*:*:*:*range: >=9.2.5,<=9.4.5
- (no CPE)range: 9.2.5 - 9.4.5
- (no CPE)range: 9.2.5
Patches
Vulnerability mechanics
References
2- seclists.org/fulldisclosure/2024/Dec/15nvdExploitMailing ListThird Party Advisory
- karmainsecurity.com/hacking-kerio-control-via-cve-2024-52875nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.