CVE-2024-52958 - CVE House

Status published Critical CVE-2024-52958

iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature

9.3 CVSS

Vulnerability Description

A improper verification of cryptographic signature vulnerability in plugin management in iota C.ai Conversational Platform from 1.0.0 through 2.1.3 allows remote authenticated users to load a malicious DLL via upload plugin function.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-52958

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://zuso.ai/advisory/za-2024-11

More from Galaxy Software Services Corporation

View All →

CVE-2025-31342

Galaxy Software Services Vitals ESP Forum Module - Unrestricted Upload of File with Dangerous Type

Critical 9.3

CVE-2024-52959

iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection')

Critical 9.3

Affected Vendor

Galaxy Software Services Corporation

View all reports →

Affected Software

iota C.ai Conversational Platform

Vulnerable Versions:

1.0.0

Timeline

Official Publish: November 27th, 2024

Last Modified: November 27th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-347

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

Initial Access

T1078 Valid Accounts

Persistence

T1550 Use Alternate Authentication Material