TI-2024-05678 Aliases CVE-2024-6127 GHSA-24r9-8wx9-6g9f

BC Security Empire Path Traversal RCE

MEDIUM 61CWE-22Published 2024-06-27 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote, unauthenticated attacker can exploit this vulnerability over HTTP by acting as a normal agent, completing all cryptographic handshakes, and then triggering an upload of payload data containing a malicious path.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.10346 95th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Empire (BC Security): 5.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
BC Security	Empire	before 5.9.3	5.9.3	Patch available	CNA

Empire VendorBC Security Affected before 5.9.3 Fixed in 5.9.3 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:bcsecurity:empire::::::::	—	—	—

cpe:2.3:a:bcsecurity:empire:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA Empire (BC Security) Fixed in 5.9.3

Timeline

2026-10-02 Threatist record created from CVE-2024-6127
2026-10-03 Alias added: GHSA-24r9-8wx9-6g9f

References

TI-2026-62494 BC Security Empire before 6.7.1 Path Traversal File Upload RCE CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences