TI-2024-35422 Aliases CVE-2024-52925

Code injection in OPSWAT MetaDefender Kiosk

LOW 32CWE-94Published 2025-02-26 · Updated 2025-02-26

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00323 25th percentileScored 2026-11-07

Fix Fixed MetaDefender Kiosk (OPSWAT): 4.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OPSWAT	MetaDefender Kiosk	before 4.7.0	4.7.0	Patch available	CNA

MetaDefender Kiosk VendorOPSWAT Affected before 4.7.0 Fixed in 4.7.0 Patch available CNA

Remediation

Fix · CNA MetaDefender Kiosk (OPSWAT) Fixed in 4.7.0

Timeline

2026-10-02 Threatist record created from CVE-2024-52925

References

Other 1

https://www.opswat.com/docs/mdkiosk/release-notes/cve-2024-52925

TI-2022-13979 OPSWAT MetaDefender Core before 5.1.2, MetaDefender ICAP before 4.12.1, and MetaDefender… CVSS 3.1CRITICAL 9.8
TI-2023-18475 An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. CVSS 3.1CRITICAL 9.8
TI-2023-18473 An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. CVSS 3.1CRITICAL 9.8
TI-2018-11657 OPSWAT MetaDefender before v4.11.2 allows CSV injection. CVSS 3.0HIGH 7.8
TI-2024-38032 An issue in Agnitum Outpost Security Suite 7.5.3 (3942.608.1810) and 7.6 (3984.693.1842)… CVSS 3.1HIGH 7.7
TI-2023-18474 An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. CVSS 3.1HIGH 7.8

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences