CVE-2024-39916

CVE-2024-39916 is a medium-severity vulnerability affecting FOG Project versions prior to 1.5.10.30, stemming from an insecure NFS configuration in the installer-generated /etc/exports file. The "no_subtree_check" option allows authenticated attackers to modify files outside the intended export directory, potentially impacting /images and other files on the same or different filesystems. With a CVSS score of 6.4, this vulnerability has a network attack vector and low attack complexity, leading to potential low impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.