Reference page — cumulative record through Wednesday, October 7, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-7694

CVE-2024-7694HIGH

TeamT5 ThreatSonar Anti-Ransomware - Arbitrary File Upload

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   H   N  U  H  H  H    7.2   .0179   77.7   YES

AFFECTED
  Product                      Versions     Fixed
  ThreatSonar Anti-Ransomware  unspecified  —

TIMELINE
  Aug 12  Reserved by twcert
  Aug 12  Published (CNA: twcert)
  Feb 17  Added to CISA KEV, remediation due 2026-03-10

CWE-434 · CNA: twcert · CVSS v3.1 · 3 references · KEV due March 10, 2026

Description

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 12, 2024	Reserved	Reserved by twcert
August 12, 2024	Published	Published (CNA: twcert)
February 17, 2026	KEV ADDED	Added to CISA KEV, remediation due 2026-03-10

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
TeamT5	ThreatSonar Anti-Ransomware	—	—	—

Weaknesses

CWE-434

References (3)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7694 [government-resource]
https://www.twcert.org.tw/en/cp-139-8000-e5a5c-2.html [third-party-advisory]
https://www.twcert.org.tw/tw/cp-132-7998-d76dd-1.html [third-party-advisory]

Authoritative record: CVE-2024-7694 at cve.org

Vendors: teamt5

Weaknesses: CWE-434

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-7694 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, October 7, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.