Vulnerability · Published Feb 21, 2025 · Assigned by CERT-PL

CVE-2024-9150Code Injection in Wyn Enterprise

High 8.7

In plain English

A high-severity security flaw in Wyn Enterprise from Wyn Enterprise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.5%top 58.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Report generation functionality in Wyn Enterprise allows for code inclusion, but not sufficiently limits what code might be included. An attacker is able use a low privileges account in order to abuse this functionality and execute malicious code, load DLL libraries and executing OS commands on a host system with applications high privileges. This issue has been fixed in version 8.0.00204.0

Affected products (as reported)

Vendor	Product	Versions
Wyn Enterprise	Wyn Enterprise	0 – before 8.0.00204.0

Weakness: CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.wynenterprise.com/ product
https://cert.pl/en/posts/2025/02/CVE-2024-9150 third-party-advisory
https://efigo.pl/blog/cve-2024-9150/ technical-description