# CVE-2024-39914: FOGProject - RCE

> Live exploitation tracking for CVE-2024-39914 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-39914

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** FOGProject
- **Weaknesses:** CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
- **Tags:** web_application

## Description

FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34.

## CrowdSec analysis

[CVE-2024-39914](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-39914) is a critical command injection vulnerability in FOGProject's fogproject suite, specifically affecting versions prior to 1.5.10.34. Attackers can exploit this flaw via the filename parameter in /fog/management/export.php, potentially allowing remote code execution on the server. This vulnerability could be leveraged for full system compromise, data theft, or disruption of imaging and management operations.

CrowdSec has been tracking this vulnerability and its exploits since 10th of December 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-39914 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
In addition, according to the CrowdSec network, attack volume against CVE-2024-39914 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the `/management/export.php` endpoint by injecting malicious commands via the `filename` parameter, enabling remote command execution on vulnerable FOG Project instances. Subsequent requests to `/management/<filename>.php` are used to verify successful code execution.

## Timeline

- 2024-07-12: CVE Published. CVE-2024-39914 is published to NVD.
- 2025-12-10: Rule Released. CrowdSec releases a rule to detect CVE-2024-39914 exploitation attempts against the CrowdSec Network.
- 2025-12-15: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-39914 for the first time.

## References

- https://github.com/FOGProject/fogproject/security/advisories/GHSA-7h44-6vq6-cq8j
- https://github.com/FOGProject/fogproject/commit/2413bc034753c32799785e9bf08164ccd0a2759f
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39914.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-39914) follows observed exploitation activity for CVE-2024-39914. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.