CVE-2024-28241: Privilege Escalation in GLPI Agent

Successful exploitation of CVE-2024-28241 allows a local attacker to gain elevated privileges on the system where the GLPI Agent is installed. This could enable them to execute arbitrary code with higher permissions, potentially compromising sensitive data, disrupting system operations, or establishing a persistent foothold. The impact is particularly severe in environments where the GLPI Agent is deployed with administrative privileges or has access to critical resources. The ability to modify DLLs introduces a significant attack surface, as malicious code can be injected into system libraries to achieve persistence and evade detection.

1. Reserved2024-03-07
2. Published2024-04-25
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-28241 is to upgrade the GLPI Agent to version 1.7.2 or later, which includes a patch addressing the vulnerability. If immediate upgrading is not feasible, a temporary workaround involves utilizing the default installation folder for the GLPI Agent. This leverages the system's inherent security mechanisms to protect the agent's files from unauthorized modification. Consider implementing least privilege principles for the GLPI Agent user account to limit the potential impact of a successful attack. After upgrading, verify the agent's integrity by checking the version number and reviewing system logs for any suspicious activity.