CVE-2024-24278: Teamwire Windows desktop client · Code Injection
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Mar 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
Until an official patch is released, organizations should implement several specific mitigations: 1) Restrict network access to the Teamwire Windows client by using firewalls or network segmentation to limit exposure to untrusted networks. 2) Monitor network traffic for unusual or suspicious payloads targeting the messaging function, employing intrusion detection systems with custom signatures if possible. 3) Enforce strict endpoint security policies, including application whitelisting and behavior monitoring, to detect anomalous activity related to Teamwire. 4) Educate users about the risk and encourage vigilance for unexpected application behavior or messages. 5) Coordinate with Teamwire support or vendor channels to obtain updates on patches or workarounds and plan timely upgrades to fixed versions once available. 6) Consider temporary use of alternative secure messaging solutions if the risk is deemed unacceptable. These targeted actions go beyond generic advice by focusing on network-level controls, monitoring, and vendor engagement specific to this vulnerability.
Description
An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the message function.