CVE-2024-39704
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on clients running vulnerable versions of Melty Blood: Actress Again: Current Code by sending a specially crafted packet to TCP port 46318. The vulnerability affects all users running versions through 1.07 Rev. 1.4.0 of the game, enabling complete system compromise.
💻 Affected Systems
- Soft Circle French-Bread Melty Blood: Actress Again: Current Code
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining full control over the victim's machine, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Game client crashes followed by arbitrary code execution, potentially leading to malware installation, credential theft, or system compromise.
If Mitigated
Network segmentation and firewall rules prevent exploitation, limiting impact to isolated gaming systems.
🎯 Exploit Status
Public proof-of-concept code is available on GitHub and Pastebin, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch is available. Users should apply workarounds or discontinue use of vulnerable versions.
🔧 Temporary Workarounds
Block TCP Port 46318
windowsPrevent exploitation by blocking incoming connections to the vulnerable port
netsh advfirewall firewall add rule name="Block Melty Blood RCE" dir=in action=block protocol=TCP localport=46318
Disable Game Network Features
allPlay in offline mode or disable multiplayer functionality
🧯 If You Can't Patch
- Segment gaming systems on isolated network VLANs
- Implement host-based firewall rules to restrict inbound connections to port 46318
🔍 How to Verify
Check if Vulnerable:
Check game version in game settings or executable properties. If version is 1.07 Rev. 1.4.0 or earlier, the system is vulnerable.Check Version:
Check game executable properties or in-game version displayVerify Fix Applied:
Verify firewall rules are blocking TCP port 46318 using 'netsh advfirewall firewall show rule name="Block Melty Blood RCE"'📡 Detection & Monitoring
Log Indicators:
- Unexpected game crashes
- Network connections to port 46318 from unknown sources
- Process creation from game executable
Network Indicators:
- TCP connections to port 46318 with unusual payload patterns
- Malformed packets to port 46318
SIEM Query:
source_port=46318 AND (payload_size>normal OR protocol_violation=true)