CVE-2025-24344

Summary

CVE-2025-24344 is a newly discovered vulnerability in the error notification messages of the web application of ctrlX OS. This issue permits a remote, unauthenticated attacker to inject malicious HTML tags into the error messages, potentially leading to the execution of arbitrary client-side code in another user's browser. The attack can be carried out through specially crafted HTTP requests, posing a serious security risk to users of the ctrlX OS web application. Attackers could exploit this vulnerability to steal sensitive information or perform unauthorized actions in a targeted victim's browser session. Users are advised to apply the recommended patch or upgrade as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.