How severe is CVE-2024-3775?

CVE-2024-3775 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-3775 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-3775?

CVE-2024-3775 primarily affects Aenrich A+hrd. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-3775?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-3775 have an EU (EUVD) identifier?

Yes. CVE-2024-3775 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-32347.

When was CVE-2024-3775 published?

CVE-2024-3775 was published on 2024-04-15 and last updated on 2026-06-17.

CVE-2024-3775

CVE-2024-3775 is a medium-severity vulnerability in Aenrich A+hrd with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-88.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-32347
Weakness: CWE-88
Affected product: Aenrich A+hrd
Published: 2024-04-15
Last modified: 2026-06-17

Description

aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.

Frequently asked questions

What is CVE-2024-3775?: aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.
How severe is CVE-2024-3775?: CVE-2024-3775 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-3775 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-3775?: CVE-2024-3775 primarily affects Aenrich A+hrd. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-3775?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-3775 have an EU (EUVD) identifier?: Yes. CVE-2024-3775 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-32347.
When was CVE-2024-3775 published?: CVE-2024-3775 was published on 2024-04-15 and last updated on 2026-06-17.

References

https://www.twcert.org.tw/tw/cp-132-7726-e5f70-1.html

Affected products (4)

cpe:2.3:a:aenrich:a\+hrd:6.8:*:*:*:*:*:*:*
cpe:2.3:a:aenrich:a\+hrd:7.0:*:*:*:*:*:*:*
cpe:2.3:a:aenrich:a\+hrd:7.1:*:*:*:*:*:*:*
cpe:2.3:a:aenrich:a\+hrd:7.2:*:*:*:*:*:*:*

More vulnerabilities in Aenrich A+hrd

CVE-2025-12871 — Critical (CVSS 9.8): The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to…
CVE-2025-12870 — Critical (CVSS 9.8): The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to…
CVE-2025-0585 — Critical (CVSS 9.8): The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to…
CVE-2023-20853 — Critical (CVSS 9.8): aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message…
CVE-2023-20852 — Critical (CVSS 9.8): aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An…
CVE-2022-39042 — Critical (CVSS 9.8): aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this…

All CVEs affecting Aenrich A+hrd →

Other CWE-88 (Argument Injection) vulnerabilities

CVE-2026-57572 — Critical (CVSS 10.0): Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted…
CVE-2026-40281 — Critical (CVSS 10.0): Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint…
CVE-2023-6269 — Critical (CVSS 10.0): An argument injection vulnerability has been identified in the administrative web interface of the Atos Unify…
CVE-2007-0882 — Critical (CVSS 10.0): Argument injection vulnerability in the telnet daemon (in.telnetd) in Solaris 10 and 11 (SunOS 5.10 and 5.11)…
CVE-2004-0480 — Critical (CVSS 10.0): Argument injection vulnerability in IBM Lotus Notes 6.0.3 and 6.5 allows remote attackers to execute arbitrary code via…
CVE-1999-0113 — Critical (CVSS 10.0): Some implementations of rlogin allow root access if given a -froot parameter.

Browse all CWE-88 (Argument Injection) vulnerabilities →