Read the docs
TI-2024-18777 Aliases CVE-2024-28211GHSA-77v6-9wph-jrmj

Deserialization of untrusted data in NAVER nGrinder

Priority MEDIUM 50CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-502.

Summary

nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI registry by remote attacker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0079 56th percentileScored 2026-11-07
Fix Fixed nGrinder (NAVER): 3.5.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NAVERnGrinder—3.5.9Patch availableCNA
  • nGrinder VendorNAVER Affected — Fixed in 3.5.9 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:*before 3.5.9VulnerableNAVER
  • cpe:2.3:a:naver:ngrinder:*:*:*:*:*:*:*:* Versions before 3.5.9 Vulnerable ·NAVER

Remediation

  • Fix · CNA nGrinder (NAVER) Fixed in 3.5.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28211
  2. 2026-10-03 Alias added: GHSA-77v6-9wph-jrmj

References

Advisory 1

  • TI-2024-18782 Missing authorization in NAVER nGrinder CVSS 3.1MEDIUM 5.4
  • TI-2024-18778 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18779 Deserialization of untrusted data in NAVER nGrinder CVSS 3.1CRITICAL 9.8
  • TI-2024-18781 Missing authorization in NAVER nGrinder CVSS 3.1HIGH 7.5
  • TI-2016-04378 Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote… CVSS 3.0MEDIUM 6.1
  • TI-2024-18780 nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of… CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences