Loading vulnerability…
A remote code execution vulnerability exists in the Logsign Unified SecOps Platform HTTP API due to the use of a hard-coded cryptographic key. This flaw allows network-adjacent attackers to execute arbitrary code as root without authentication by exploiting the API's cryptographic implementation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a standalone exploit set for Logsign Unified SecOps Platform vulnerabilities, centered on a Python proof-of-concept in exploit.py plus supporting Metasploit and Nuclei content. The main Python exploit chains CVE-2024-5716 and CVE-2024-5717: it triggers the forgot-password flow for a chosen user (default admin), brute-forces the 6-digit reset code using multiple threads, extracts the returned verification_code, resets the password, logs in, and then abuses the authenticated /api/settings/demo_mode endpoint to inject and execute attacker-controlled commands. The PoC supports direct command execution, a reverse-shell mode, and a default proof action that writes a file on the target. The repository also includes a Metasploit auxiliary module for the auth-bypass/reset issue only, a full Metasploit exploit module that delivers a Meterpreter session by wrapping the framework payload in a bash command and injecting it into demo_mode, and a Nuclei template that fingerprints potentially vulnerable Logsign instances by querying /api/settings/license_status and matching product/version strings. Overall, this is a real, operational network/web exploit repository targeting pre-authentication compromise of Logsign appliances, with clear offensive capability beyond mere detection.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.