CVE-2024-39024

CVE-2024-39024 is an authenticated RCE in Packetfence's administrative WebGui, scored 8.8 by CVSS. That number badly understates the operational severity because this isn't a typical application-level compromise—Packetfence sits at the layer where your network decides whether to trust a device. Compromising a NAC enforcement point gives an attacker the ability to corrupt the trust model itself: modify segmentation policies, exfiltrate RADIUS shared secrets, or pivot laterally through every device the NAC controls. This is fundamentally different from RCE in a webapp that happens to run on important infrastructure—here, the attacker owns the mechanism that determines what your other security controls consider trusted. The vulnerability lives in an 'interface setting'—a configuration parameter in the admin GUI that flows into privileged system calls without proper boundary checks. This is a known pattern in network management tooling, but it's particularly dangerous in NAC because the admin interface is architecturally positioned as a proxy for trusted administrative intent. The key question for your environment: does this exploit require superadmin credentials, or can a lower-privilege operator account trigger the RCE? If it's the latter, you have not just an RCE—you have a privilege-escalation path that lets a tiered operator corrupt your entire network trust model. That dramatically expands your exploitability window. For immediate action: verify the patch version (13.2.0 was vulnerable; confirm the patched release you should be on), audit your Packetfence admin accounts for necessity and credential hygiene, and treat any admin-level compromise in your NAC as a network-wide incident, not an application-level one. But the deeper question is whether Packetfence's role model supports capability separation at all—if your admin accounts effectively have full system access through the GUI by design, this CVE is a preview of future vulnerabilities in the same category.

Reviewed through automated stages and approved by a human before publication.