CVE-2024-4577: PHP-CGI soft hyphen argument injection on Windows
HoneyLabs honeypots recorded 66 probes matching CVE-2024-4577 from 14 distinct source IP addresses in the last 7 days, of which 2 on interactive sensors. Severity is rated critical.
This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2024-06-12.
One source probed for CVE-2024-4577 on the interactive sensors. It did not send the exploit payload.
What the sensors show
Probes arrived on 6 of the 7 days in this window. The busiest day was 2026-11-08, with 16. No single address sent more than 12% of them. The largest source network was AS45090 (Shenzhen Tencent Computer Systems Company Limited), with 18% of the probes from 2 addresses. It is still being probed 2 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 3,603 probes for it. The probing clients presented 3 distinct TLS fingerprints, most often t13d1312h2_a44d0ee8b3cc_e381dae6da6b.
Request paths that identify it
- /php-cgi/php-cgi.exe
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 196.189.236.67 | 8 | Ethio Telecom | Ethiopia |
| 31.57.34.150 | 8 | Blockchain Creek B.V. | The Netherlands |
| 49.235.131.69 | 8 | Shenzhen Tencent Computer Systems Company Limited | China |
| 125.141.72.225 | 4 | Korea Telecom | South Korea |
| 147.15.15.226 | 4 | Oracle Corporation | Brazil |
| 172.71.120.130 | 4 | Cloudflare, Inc. | Canada |
| 177.10.160.46 | 4 | Chapeco Tecnologia em Telecomunicacoes Ltda. | Brazil |
| 37.120.213.13 | 4 | M247 Europe SRL | Switzerland |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS45090 | Shenzhen Tencent Computer Systems Company Limited | 12 | 2 |
| AS207994 | Blockchain Creek B.V. | 8 | 1 |
| AS24757 | Ethio Telecom | 8 | 1 |
| AS13335 | Cloudflare, Inc. | 6 | 2 |
| AS12876 | Scaleway SAS | 4 | 1 |
| AS132203 | Tencent Building, Kejizhongyi Avenue | 4 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| China | 12 |
| Brazil | 8 |
| Ethiopia | 8 |
| The Netherlands | 8 |
| Singapore | 8 |
| South Korea | 6 |
Captured requests
- /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
- /index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input
- /cgi-bin/php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
- /test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input
Requests the interactive sensors answered
- POST /php-cgi/php-cgi.exe?%ADd+allow_url_include=1+%ADd+auto_prepend_file=[php]://input
HTTP client fingerprints
- b11cuq070_00050835_c0b30902
- b11cuq136_80050813_f44850b6_x379753ab95539f8fdafedf99
- b11cuq050_00050814_6eb31df9
CVE report
Open a specific CVE from the CVE tracker.