Security Digest · Vulnerability record · Known exploited
CVE-2024-4978: Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability
Exploited in the wild (CISA KEV). Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature.
CISA KEV · added 2024-05-29 CVSS 8.7 High EPSS 26.9% · p98
Should you act?
Exploited: patch now if you run it
CISA has confirmed exploitation in the wild. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Yes, if you run Justice AV Solutions Viewer. CISA added this CVE to its Known Exploited Vulnerabilities catalog on 2024-05-29, which means there is reliable evidence of exploitation in the wild. US federal agencies must remediate by 2024-06-19; treat that as the outer limit, not the target.
- EPSS 26.9%, percentile 98: FIRST’s model estimates a 26.9% chance of exploitation activity in the next 30 days, higher than 98% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
What it is
Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.
CISA’s summary
Justice AV Solutions (JAVS) Viewer installer contains a malicious version of ffmpeg.exe, named fffmpeg.exe (SHA256: 421a4ad2615941b177b6ec4ab5e239c14e62af2ab07c6df1741e2a62223223c4). When run, this creates a backdoor connection to a malicious C2 server.
Weakness type: CWE-506.
Product: Justice AV Solutions Viewer · Assigned by: cisa-cg · Published: 2024-05-23
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| Justice AV Solutions | Viewer | 8.3.7.250 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| cisa-cg | 3.1 | 8.4 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H |
| cisa-cg | 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Attack requirements: present (depends on deployment conditions)
- Privileges required: high (admin)
- User interaction: active
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: added 2024-05-29; federal due date 2024-06-19. Known ransomware use: Unknown.
- CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CISA SSVC assessment: exploitation active, automatable no, technical impact total.
- FIRST EPSS (model of 2026-10-21): 26.94% probability of exploitation activity in the next 30 days; percentile 98.
Timeline
- — CVE record published by cisa-cg
- — Added to CISA’s Known Exploited Vulnerabilities catalog
- — CISA remediation deadline for US federal agencies
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vendor and project advisories, patches
- Listed in CISA KEV notes (rapid7.com) rapid7.com
- Listed in CISA KEV notes (javs.com) javs.com
Vulnerability records
- CVE.org record CVE-2024-4978 cve.org
- NVD entry CVE-2024-4978 nvd.nist.gov
Government
Other references from the CVE record and advisory
- twitter.com twitter.com
- rapid7.com rapid7.com
All exploited Justice AV Solutions vulnerabilities · Today’s Security Digest