CVE-2024-25089
📋 TL;DR
This vulnerability in Malwarebytes Binisoft Windows Firewall Control allows remote attackers to execute arbitrary code via gRPC named pipes. Attackers can exploit this to run malicious code on affected systems. Users running vulnerable versions of Windows Firewall Control are affected.
💻 Affected Systems
- Malwarebytes Binisoft Windows Firewall Control
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Remote attackers gaining unauthorized access to execute arbitrary commands, potentially leading to lateral movement within networks.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented, though exploitation risk remains.
🎯 Exploit Status
Exploitation requires network access to the named pipe interface, which may be accessible remotely depending on configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.9.9.2
Vendor Advisory: https://www.binisoft.org/changelog.txt
Restart Required: Yes
Instructions:
1. Download Windows Firewall Control version 6.9.9.2 or later from the official website. 2. Run the installer to upgrade. 3. Restart the system to ensure changes take effect.
🔧 Temporary Workarounds
Disable gRPC named pipe access
windowsRestrict or disable gRPC named pipe communication to prevent remote exploitation.
netsh advfirewall firewall add rule name="Block WFC gRPC" dir=in action=block program="C:\Program Files\Binisoft\Windows Firewall Control\wfc.exe" enable=yes
Network segmentation
allIsolate systems running vulnerable software from untrusted networks.
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to affected systems
- Monitor for suspicious named pipe activity and unauthorized process execution
🔍 How to Verify
Check if Vulnerable:
Check the installed version of Windows Firewall Control in the application's About section or via Programs and Features.Check Version:
wmic product where name="Windows Firewall Control" get versionVerify Fix Applied:
Confirm version is 6.9.9.2 or higher in the application interface.📡 Detection & Monitoring
Log Indicators:
- Unusual named pipe creation or access events
- Suspicious process execution originating from Windows Firewall Control
Network Indicators:
- Unexpected network connections to/from systems running Windows Firewall Control
- Anomalous gRPC traffic patterns
SIEM Query:
EventID=4688 AND ProcessName="wfc.exe" AND CommandLine CONTAINS "-grpc"