CVE-2024-7694: ThreatSonar Anti-Ransomware unrestricted file upload enables command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw gives authenticated administrators remote code execution on a security appliance and is listed in CISA KEV as exploited in the wild, though it requires high privileges to reach.

What it is

ThreatSonar Anti-Ransomware from TeamT5 fails to properly validate the content of uploaded files (CWE-434). An attacker holding administrator privileges on the platform can upload a malicious file that is then used to execute arbitrary system commands on the server. Because the flaw leads to remote code execution on a security product, it matters for any internet-reachable deployment.

Impact

An attacker with platform administrator rights gains arbitrary command execution on the server hosting ThreatSonar Anti-Ransomware, allowing full compromise of that host and any data or credentials it holds.

Attack surface

Reachable over the network via the product's file upload functionality (CVSS vector AV:N). The vector requires high privileges (PR:H) and no user interaction (UI:N), so the attacker must already hold an administrator account on the platform.

Exploitation

CVE-2024-7694 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2026-02-17), indicating exploitation in the wild; EPSS 30-day probability is low at 0.018 (77th percentile). No ransomware campaign use is documented.

What to do

• Apply the vendor fix or mitigations referenced in the TeamT5/TWCERT advisories; if no fix is available, follow CISA BOD 22-01 guidance or discontinue use of the product.
• Restrict network access to the ThreatSonar management interface so it is not exposed to untrusted networks.
• Enforce least privilege and strong authentication for platform administrator accounts, and audit who holds them.
• Monitor and restrict file upload activity on the appliance, and validate uploaded content where possible.

Detection

• Review ThreatSonar upload logs and file storage for unexpected or unusual uploaded files, especially executables or scripts.
• Alert on suspicious child processes spawned by the ThreatSonar service or web server (for example shells or command interpreters).
• Audit administrator account activity and authentication events on the platform for anomalous logins or uploads.
• Monitor outbound network connections from the ThreatSonar host for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.