Automai Director Arbitrary Code Execution Vulnerability via Update Mechanism
Vulnerability
A vulnerability in Automai Director version 25.2.0 allows remote attackers to execute arbitrary code by exploiting the update mechanism. The issue arises because the update process fails to properly validate or restrict update sources and content, enabling attackers to inject and execute system commands during updates. This vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type, and it requires authentication to exploit.
Impact
Exploitation of this vulnerability allows for arbitrary code execution, which could lead to full system compromise, unauthorized data manipulation, or the installation of persistent malware.
Remediation
Users are advised to update to the latest version of Automai Director, as the vendor has acknowledged the vulnerability and released a fix.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.