FOGProject - RCE (CVE-2024-39914)

CVE-2024-39914 is a critical command injection vulnerability in FOGProject's fogproject suite, specifically affecting versions prior to 1.5.10.34. Attackers can exploit this flaw via the filename parameter in /fog/management/export.php, potentially allowing remote code execution on the server. This vulnerability could be leveraged for full system compromise, data theft, or disruption of imaging and management operations.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-39914 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2024-39914 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /management/export.php endpoint by injecting malicious commands via the filename parameter, enabling remote command execution on vulnerable FOG Project instances. Subsequent requests to /management/<filename>.php are used to verify successful code execution.