A critical vulnerability in GFI KerioControl firewalls is being actively exploited by threat actors to achieve one-click remote code execution (RCE). This flaw, tracked as CVE-2024-52875, is caused by improper input sanitization leading to multiple HTTP response splitting vulnerabilities, allowing attackers to perform reflected cross-site scripting (XSS) attacks by injecting malicious inputs into HTTP headers. Discovered by security researcher Egidio Romano, the flaw impacts KerioControl versions 9.2.5 through 9.4.5, and has persisted in the software for about seven (7) years. Exploitation involves crafting a malicious URL that, when clicked by an authenticated administrator, uploads a malicious “.img” file via the firmware upgrade feature, granting root access to the firewall. GreyNoise reported that exploitation attempts began on December 28, 2024, originating from IP addresses in Singapore and Hong Kong, despite a patch being released on December 19, 2024. With nearly 24,000 internet-exposed instances worldwide, including in Iran, Uzbekistan, Italy, and the United States, the flaw poses a high risk, especially since attackers can combine social engineering tactics with unauthenticated access to vulnerable URI paths. CTIX analysts strongly advise impacted users to update to version 9.4.5 Patch 1, which addresses the vulnerability and strengthens defenses against XSS exploits.