CVE-2024-7448: Magnet Forensics Axiom RCE Vulnerability

CVE-2024-7448 Overview

CVE-2024-7448 is a command injection vulnerability in Magnet Forensics AXIOM, a widely used digital forensics platform. The flaw resides in the Android device image acquisition functionality. A network-adjacent attacker can execute arbitrary code when an investigator acquires data from a malicious mobile device. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-23964 and tracked as ZDI-24-1129. The weakness maps to [CWE-78] (OS Command Injection) and affects AXIOM version 8.0.0.39753.

Critical Impact
Successful exploitation allows arbitrary command execution in the context of the AXIOM user, potentially compromising forensic workstations and the integrity of ongoing investigations.

Affected Products

Magnet Forensics AXIOM 8.0.0.39753
AXIOM Android device image acquisition component
Forensic workstations running vulnerable AXIOM builds

Discovery Timeline

2024-08-21 - CVE-2024-7448 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7448

Vulnerability Analysis

The vulnerability exists in the Android device image acquisition workflow of Magnet Forensics AXIOM. When an examiner connects an Android device and initiates acquisition, AXIOM reads identifying strings from the device and passes them into a system-level command. The application does not sanitize or validate these device-supplied strings before concatenating them into a shell invocation. An attacker who controls the Android device (or a device that emulates one) can craft malicious metadata that breaks out of the intended command and injects arbitrary operating system commands.

Exploitation requires user interaction from the investigator, who must attach and begin acquisition from the malicious device. Because forensic workstations typically run with elevated privileges and hold sensitive case data, code execution in this context threatens both the host and evidence chain-of-custody.

Root Cause

The root cause is missing input validation of user-supplied strings passed to a system call ([CWE-78]). AXIOM trusts attacker-controllable data returned by the connected Android device and interpolates it directly into a command-line executed by the underlying shell.

Attack Vector

The attack vector is adjacent-network with required user interaction. The examiner must connect the malicious device and initiate an Android acquisition. Once initiated, injected commands execute automatically with the privileges of the AXIOM process. See the Zero Day Initiative advisory ZDI-24-1129 for technical details.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered when AXIOM invokes a system command
// using an unsanitized identifier string read from an attacker-controlled
// Android device during image acquisition.

Detection Methods for CVE-2024-7448

Indicators of Compromise

Unexpected child processes spawned by the AXIOM application or its acquisition helper binaries during or after an Android acquisition.
Shell interpreters (cmd.exe, powershell.exe) launched by AXIOM with unusual command-line arguments containing device identifier fields.
Outbound network connections from forensic workstations initiated shortly after connecting an Android device.

Detection Strategies

Monitor process-creation telemetry on forensic workstations for AXIOM spawning shells or scripting hosts.
Alert on command lines that include shell metacharacters (;, &, |, backticks) sourced from device metadata.
Correlate USB device connection events with subsequent anomalous process trees on the same host.

Monitoring Recommendations

Enable endpoint detection and response (EDR) telemetry on all forensic workstations, including process, file, and network events.
Baseline AXIOM's normal process tree so that deviations during Android acquisition surface quickly.
Retain host logs for the duration of active cases to preserve investigative and forensic auditability.

How to Mitigate CVE-2024-7448

Immediate Actions Required

Upgrade Magnet Forensics AXIOM to the latest fixed release as listed in the Magnet Forensics release notes.
Restrict Android device acquisition to trusted evidence handled through validated custody procedures.
Isolate forensic workstations from production networks and limit outbound connectivity.

Patch Information

Magnet Forensics has addressed the issue in an updated AXIOM build. Review the vendor's release notes to identify the fixed version and apply the update to all forensic workstations running 8.0.0.39753 or earlier.

Workarounds

Avoid Android image acquisition on unpatched AXIOM installations when the source device provenance cannot be verified.
Perform acquisitions on isolated, non-persistent virtual machines that can be reverted after each case.
Run AXIOM under a least-privilege account so that any injected command executes with minimal host impact.

bash

# Verify installed AXIOM version on Windows forensic workstations
reg query "HKLM\SOFTWARE\Magnet Forensics\AXIOM Process" /v Version

# Example EDR hunt: AXIOM spawning a shell interpreter
# process_parent_name IN ("AXIOMProcess.exe","AXIOMExamine.exe")
#   AND process_name IN ("cmd.exe","powershell.exe","conhost.exe")