CVE-2024-23759: Gambio Parcelshopfinder search parameter deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, no user interaction, and a very high EPSS score plus an exploit-tagged reference make this an urgent remote code execution risk.

What it is

Gambio through 4.9.2.0 deserializes untrusted data passed via the "search" parameter of the Parcelshopfinder/AddAddressBookEntry function. Because the input is not safely handled, an unauthenticated remote attacker can trigger deserialization of attacker-controlled data. The flaw is rated critical (CVSS 9.8) and has a high EPSS score, so it warrants prompt attention.

Impact

An attacker can execute arbitrary code on the Gambio server, leading to full compromise of confidentiality, integrity and availability. This could allow data theft, webshell deployment or use of the host as a pivot point.

Attack surface

Reachable over the network via the "search" parameter of the Parcelshopfinder/AddAddressBookEntry function. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.47549 (98.8th percentile) and the reference is tagged "Exploit", indicating public exploit material exists. No ransomware association is documented.

What to do

• Upgrade Gambio past 4.9.2.0 to a fixed release as soon as a vendor patch is available.
• If patching is not immediately possible, restrict or block access to the Parcelshopfinder/AddAddressBookEntry endpoint at the WAF or reverse proxy.
• Disable the Parcelshopfinder feature if it is not required for business operations.
• Apply input validation and reject serialized payloads on the "search" parameter at the application or WAF layer.
• Monitor Gambio vendor advisories for an official fix and version guidance.

Detection

• Inspect web and application logs for requests to Parcelshopfinder/AddAddressBookEntry with serialized or base64-encoded data in the "search" parameter.
• Alert on unexpected child processes spawned by the web server or PHP-FPM (for example shells, curl, wget).
• Monitor for new or modified files under the Gambio web root that could indicate webshell placement.
• Use WAF or IDS signatures for Java/PHP deserialization patterns in HTTP parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.