VulnSocial

CVE-2024-2961PoC(debian / active_iq_unified_manager)

MEDIUMCVSS 7.3 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for debian active_iq_unified_manager systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.

debian CVEsBack to dashboard
4.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-787

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • active_iq_unified_manager
  • debian_linux
  • glibc
  • hci_compute_node

Threat summary

  • Public PoC and exploit tooling are both present
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 2 signals
  • PoC mentioned or linked in 3 signals
  • Technical details provided in 3 signals
  • Peaked 2d ago at 1 mentions (2026-05-19); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
debiangnunetapp
Products
active_iq_unified_managerdebian_linuxglibchci_compute_nodehci_h300shci_h300s_firmwarehci_h410chci_h410c_firmwarehci_h410shci_h410s_firmware

2 versions affected across 21 products

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-05-19: 1Mentions · 2026-06-23: 1Mentions · 2026-07-12: 1PoC Mentioned / Linked · 2026-05-19: 1PoC Mentioned / Linked · 2026-06-23: 1PoC Mentioned / Linked · 2026-07-12: 1Exploit Tool / Code · 2026-05-19: 1Exploit Tool / Code · 2026-06-23: 1Technical Details · 2026-05-19: 1Technical Details · 2026-06-23: 1Technical Details · 2026-07-12: 105-1906-2307-12
Signal classification1 categories
PoC
3100.0%
Referenced assets3 URLs
Full discourse3 posts
  • Frank Wu@FrankOverF1ow
    PoC

    See you on Vegas! Will share one of the most exciting exploit tricks I have found with @Nyaaaaa_ovo Remote 1-byte OOB → ASLR leak → full RCE on the hardened PHP using built-in, remotely sprayable obects. (can you make https://blog.lexfo.fr/iconv-cve-2024-2961-p1.html work on the latest PHP?) https://t.co/4VdvTd9vSx

    Post summary

    The tweet announces a newly discovered memory‑corruption exploit (1‑byte OOB) that leaks ASLR information and achieves full RCE in hardened PHP, and points to a blog likely containing a PoC implementation.

    32022166714.3K
    1.5K followersView on X
  • Densel@luckyhacker43
    PoC

    Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine by Fol 👾💥 👨‍💻 Charles Fol / LEXFO 🔗 https://blog.lexfo.fr/iconv-cve-2024-2961-p1.html Join team 👉https://t.me/luckyhacker43 https://t.co/aX1hW8T2Eh

    Post summary

    The text promotes a blog post by Charles Fol/LexFO that presents a Proof of Concept for CVE‑2024‑2961, showing how glibc can be exploited via iconv to achieve remote code execution in the PHP engine.

    1312051.3K
    3.6K followersView on X
  • r0otk3r@r0otk3r
    PoC

    🚨 CVE-2024-2961: High-Severity glibc iconv Buffer Overflow to RCE ("CNEXT") https://www.youtube.com/watch?v=kWCmlgID-Gw #Cybersecurity #Infosec #AppSec #RCE #glibc #Linux #PHP #CNEXT #CVE20242961 #PoC #EthicalHacking #BugBounty #PatchNow https://t.co/WTVCtmIrfx

    Post summary

    The tweet shares a YouTube video demonstrating a PoC for CVE‑2024‑2961, a high‑severity glibc iconv buffer overflow leading to RCE. It does not mention exploit tools, active attacks, patches, or debunking.

    0001064
    43 followersView on X
CPE platform detail22 entries

22 of 22 entries

PartVendorProductVersionTarget SWTarget HW
OSdebiandebian_linux10.0--
Appgnuglibc---
Appnetappactive_iq_unified_manager-vmware_vsphere-
HWnetapphci_compute_node---
OSnetapphci_compute_node---
HWnetapphci_h300s---
OSnetapphci_h300s_firmware---
HWnetapphci_h410c---
OSnetapphci_h410c_firmware---
HWnetapphci_h410s---
OSnetapphci_h410s_firmware---
HWnetapphci_h500s---
OSnetapphci_h500s_firmware---
HWnetapphci_h610c---
OSnetapphci_h610c_firmware---
HWnetapphci_h610s---
OSnetapphci_h610s_firmware---
HWnetapphci_h615c---
OSnetapphci_h615c_firmware---
HWnetapphci_h700s---
OSnetapphci_h700s_firmware---
Appnetappontap_select_deploy_administration_utility---

Explore more

Back to dashboarddebian CVEsgnu CVEsnetapp CVEsactive_iq_unified_manager vulnerabilities