CVE-2024-3775 is a medium severity vulnerability (CVSS 5.3) in aEnrich a+HRD. The download function that calls youtube-dl.exe does not restrict user input, so attackers can pass arbitrary arguments and download partial unauthorized files. The record points to a TWCERT notice.
What's affected
- aEnrich Technology a+HRD, with versions 6.8, 7.0 and 7.1 listed in the record's product data.
Severity in the record: Medium, CVSS 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. In plain terms: over the network, no privileges required, no user interaction. Weakness class: CWE-88, argument injection.
Fixed version: The record points to a TWCERT notice. Check it for the fixed release and update instructions from aEnrich.
The record's KEV flag is false, so this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no source reviewed here reports exploitation in the wild.
How to check if you're exposed
- Inventory where aEnrich a+HRD is deployed, including test and forgotten servers.
- Search your servers and container images for the product name and compare the version against the affected list above.
- If you cannot confirm the version, treat the installation as exposed until the vendor says otherwise.
What to do now
- Install the update described in the TWCERT notice or from the vendor.
- Limit who can reach the download feature.
- Review server logs for unexpected download activity.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3775.
Why it matters
Argument injection is a close relative of command injection. The application does call a fixed program, but it lets user input become extra command line options. The program then honors flags the developer never meant to expose. Fixes include building the argument list in code, rejecting values that start with a dash, and ending option parsing before user data.
The program involved is a video downloader called by the application. When user input goes straight onto its command line, the user decides which options it runs with. The record limits the stated impact to downloading partial unauthorized files, which is why the score is Medium.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Is this remote code execution?
The record does not say so. It describes passing arbitrary arguments and downloading partial unauthorized files. Read the TWCERT notice for the full scope.
Is CVE-2024-3775 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
