CVE-2024-4978

What it actually does

CVE-2024-4978 is a malicious-package/supply-chain compromise affecting Justice AV Solutions Viewer Setup version 8.3.7.250-1. The installer contains an embedded malicious binary and is signed with an unexpected Authenticode certificate rather than the expected trusted publisher signature. When a user executes the installer, the malicious component can run unauthorized PowerShell commands with the privileges of the executing user, enabling code execution, payload staging, credential access, persistence, lateral movement, or further malware deployment. The issue is known to have been exploited in the wild and is listed in CISA KEV.

Why it matters to the business

Organizations using JAVS Viewer may have unknowingly installed a compromised application installer, creating risk of endpoint compromise in environments that often handle sensitive audio/video recordings, legal proceedings, evidence, or operational records. Successful exploitation can lead to data theft, disruption of recording/review workflows, loss of confidence in evidentiary integrity, credential compromise, and broader network intrusion. Because this vulnerability is in CISA KEV with a remediation due date of 2024-06-19 and active exploitation has been observed, any remaining exposure should be treated as overdue and high priority, even though this CVE is not currently marked as used in ransomware campaigns.

How an attack unfolds

An attacker first obtains or distributes the compromised JAVS Viewer Setup 8.3.7.250-1 installer. A targeted user or administrator then runs the installer, satisfying the user-interaction requirement. During installation, the embedded malicious binary executes and invokes unauthorized PowerShell activity. Those PowerShell commands can be used to download or unpack additional payloads, establish command-and-control access, collect host and credential data, and prepare follow-on actions. Because the installer appears to be related to legitimate JAVS Viewer software, execution may blend into normal software installation activity unless teams validate the installer version, publisher signature, and child-process behavior. Systems where this installer executed should be considered potentially compromised, not merely vulnerable.

How to fix it

Remove and quarantine any copy of JAVS Viewer Setup 8.3.7.250-1 and do not use it for installation or reinstallation. Uninstall the affected JAVS Viewer build where present and reinstall only a current, vendor-provided, trusted version obtained from an official source. Because the vulnerable artifact is a malicious installer, treat endpoints where it was executed as potentially compromised: isolate the host, acquire forensic data if needed, reimage or rebuild high-risk systems, rotate credentials used on the host, and review for persistence or secondary payloads. Validate Authenticode signatures before deployment and ensure the publisher matches the expected Justice AV Solutions signing identity. Block execution of known-bad installer names and hashes where available in EDR, application control, and software distribution tooling.

How to confirm the fix worked

Confirm that no endpoint retains or executes JAVS Viewer Setup 8.3.7.250-1. Inventory installed JAVS Viewer versions and verify that installations come from a trusted current vendor package rather than the affected installer. Validate installer and executable Authenticode signatures and flag any JAVS-related installer signed by an unexpected publisher. Review EDR, Sysmon, Windows Security Event ID 4688, and PowerShell Operational logs for execution of the affected installer and any child powershell.exe process. If the installer was executed, validate remediation by confirming removal of suspicious dropped files, absence of unauthorized PowerShell activity, no persistence artifacts, no suspicious outbound network connections, and successful credential rotation for accounts used on the endpoint.

Typical attack path

1. Attacker distributes or causes use of the compromised JAVS Viewer Setup 8.3.7.250-1 installer.
2. A user or administrator executes the installer on a Windows endpoint.
3. The installer drops or launches an embedded malicious binary signed by an unexpected Authenticode publisher.
4. The malicious component starts unauthorized PowerShell commands.
5. PowerShell stages additional commands or payloads, collects host context, or contacts attacker-controlled infrastructure.
6. Attacker uses the foothold for credential access, persistence, lateral movement, data collection, or additional malware deployment.

How to detect it

Look for historical evidence that the affected installer was downloaded, staged, or executed. Relevant sources include EDR process telemetry, Windows Security Event ID 4688, Sysmon Event IDs 1, 7, 11, and 3, PowerShell Operational Event IDs 4103 and 4104, software deployment logs, browser/download history, proxy logs, DNS logs, and file integrity or application inventory data. Focus on execution of JAVS Viewer Setup 8.3.7.250-1, unexpected Authenticode signer information, creation of suspicious JAVS-related binaries, and any installer process spawning powershell.exe, cmd.exe, wscript.exe, mshta.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, curl.exe, or similar tooling. Review PowerShell script block logs for encoded commands, web downloads, execution-policy bypasses, hidden windows, and commands launched from installer-related parent processes. If execution is confirmed, perform full compromise assessment for persistence, credential access, lateral movement, and outbound command-and-control activity around and after the install time.

• JAVS Viewer Setup 8.3.7.250-1.exe
• JAVS Viewer Setup 8.3.7.250-1
• 8.3.7.250-1
• fffmpeg.exe
• Vanguard Tech Limited
• ParentImage=*JAVS Viewer Setup 8.3.7.250-1.exe* Image=*\\powershell.exe
• JAVS Viewer Setup 8.3.7.250-1.exe powershell.exe
• powershell.exe -ExecutionPolicy Bypass
• powershell.exe -EncodedCommand
• powershell.exe -enc
• Get-AuthenticodeSignature *JAVS Viewer Setup 8.3.7.250-1.exe*

What your security team should do

• Immediately search endpoint and software repositories for JAVS Viewer Setup 8.3.7.250-1 and quarantine any copies found.
• Prioritize investigation of any host where the affected installer executed; treat execution as a compromise indicator, not just vulnerable software presence.
• Isolate impacted endpoints until forensic triage confirms no persistence, payload staging, credential theft, or lateral movement.
• Reinstall JAVS Viewer only from a trusted current vendor source and validate Authenticode signatures before redeployment.
• Create detections for JAVS Viewer installer execution spawning PowerShell, cmd, script interpreters, or network utilities.
• Review PowerShell logs, process creation logs, EDR telemetry, and network egress around the time of installation.
• Rotate credentials used on affected endpoints, especially local administrator, domain administrator, service, and application credentials.
• Block the affected installer version through EDR, application control, software deployment tooling, and email/web gateways.
• Because the CISA KEV due date has passed, report remediation status as overdue until all affected artifacts and installations are removed or validated clean.