Path traversal in Insight Remote Support (IRS) - CVE-2024-53676
Published: December 3, 2024 / Updated: December 17, 2025
Vulnerability identifier: #VU101126
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-53676
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within the implementation of the processAtatchmentDataStream method. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system, leading to arbitrary code execution.
Affected software
Insight Remote Support (IRS)
Insight Remote Support Clients
Insight Remote Support Clients
How to mitigate CVE-2024-53676
Install update from vendor's website.
Insight Remote Support (IRS) - update to 7.14.0.629
Insight Remote Support Clients - update to 7.14.0.629
Insight Remote Support Clients - update to 7.14.0.629