CVE-2009-4648 affects Accellion Secure File Transfer Appliance versions prior to 8_0_105, allowing local administrators to escalate privileges. The vulnerability stems from improper restriction of sensitive commands and arguments executed with sudo, specifically through arbitrary arguments in admin.pl's --file_move action or hard link attacks involving chmod or cp. With a CVSS score of 7.2 (High), successful exploitation grants complete confidentiality, integrity, and availability impact. While not listed in CISA KEV and with no active exploitation observed, public exploit code exists on ExploitDB, though community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7_0_135CPE matchmatch criteria | cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_135:*:*:*:*:*:*:* | ||
7_0_178CPE matchmatch criteria | cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_178:*:*:*:*:*:*:* | ||
7_0_189CPE matchmatch criteria | cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_189:*:*:*:*:*:*:* | ||
7_0_259CPE matchmatch criteria | cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_259:*:*:*:*:*:*:* | ||
7_0_296CPE matchmatch criteria | cpe:2.3:h:accellion:secure_file_transfer_appliance:7_0_296:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.5 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.