{"id":"CVE-2024-4978","published":"2024-05-23T02:15:09Z","modified":"2026-06-17T08:03:19Z","title":"Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability","vendor":"Justice AV Solutions","product":"Viewer ","tier":"core","eol":null,"description":{"text":"Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized PowerShell commands.","provenance":"source","from":"NVD"},"summary":{"text":"The Justice AV Solutions (JAVS) Viewer installer contains embedded malicious code, present in the Viewer installer package and signed with an unexpected Authenticode signature. A remote attacker holding privileged access can use this to run unauthorized PowerShell commands, with user interaction required and a changed scope.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:41Z"},"cvss":{"score":8.4,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.26937,"percentile":0.98034,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-05-29","dueDate":"2024-06-19","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"Please follow the vendor’s instructions as outlined in the public statements at https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack#remediation and https://www.javs.com/downloads;  https://nvd.nist.gov/vuln/detail/CVE-2024-4978","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-05-23","exploitedFirstSeen":"2024-05-23","ransomware":false,"evidence":[{"url":"https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/","date":"2024-05-23"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-05-29"},{"url":"https://www.cert.europa.eu/publications/threat-intelligence/tlr2024/pdf","date":"2025-02-25"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-506","name":"Embedded Malicious Code"}],"references":[{"url":"https://twitter.com/2RunJack2/status/1775052981966377148","tags":["Third Party Advisory"]},{"url":"https://www.javs.com/downloads/","tags":["Broken Link","Product"]},{"url":"https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/","tags":["Exploit","Third Party Advisory"]},{"url":"https://twitter.com/2RunJack2/status/1775052981966377148","tags":["Third Party Advisory"]},{"url":"https://www.javs.com/downloads/","tags":["Broken Link","Product"]},{"url":"https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4978","tags":["US Government Resource"]}],"techniques":[{"id":"T1195.002","name":"Compromise Software Supply Chain","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"primary_impact","evidence":[],"comment":"CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1071.001","name":"Web Protocols","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-4978 is a vulnerability where compromised software is signed and hosted on the legitimate software distribution website. Adversaries have been observed to use this backdoored software to install additional tools on target machines. The adversary-installed software establishing persistent communications with a command-and-control (C2) server using Windows sockets and WinHTTP requests. Once successfully connected, it transmits data about the compromised host, including hostname, operating system details, processor architecture, program working directory and the user name to the C2.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-44535","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44535","exploited":true,"exploitedSince":"2024-05-29","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/"],"flow":[{"stage":"exploitation","techniques":["T1195.002"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1005","T1071.001"],"provenance":"source"}],"timeline":[{"date":"2024-05-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4978","provenance":"source"},{"date":"2024-05-23","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.rapid7.com/blog/post/2024/05/23/cve-2024-4978-backdoored-justice-av-solutions-viewer-software-used-in-apparent-supply-chain-attack/","provenance":"source"},{"date":"2024-05-29","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-05-29","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-44535","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":6},"priority":{"score":68.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 890 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.61,"detail":"percentile 0.9803"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.88,"detail":"base score 8.4"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}