CVE-2024-7235: 
AVG Antivirus vulnerability analysis and mitigation

AVG AntiVirus Free Link Following Denial-of-Service Vulnerability affects installations of AVG AntiVirus Free. The vulnerability was discovered and reported to the vendor on December 8, 2023, and was publicly disclosed on July 29, 2024, tracked as CVE-2024-7235. The affected software version is AVG AntiVirus Free 23.11.8635.809 (NVD, ZDI Advisory).

The vulnerability exists within the AVG Service and is classified as a Link Following vulnerability (CWE-59). It has been assigned a CVSS v3.1 base score of 5.5 (Medium) by NIST with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, while Zero Day Initiative rates it at 6.1 (Medium) with vector string CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H (NVD).

When successfully exploited, this vulnerability allows attackers to create a denial-of-service condition on the affected system. The attack can be leveraged by abusing the service to create a folder through symbolic link manipulation (ZDI Advisory).

The vulnerability was fixed in the February 2024 firmware version 24.Xx. Users are advised to update to this or later versions to protect against potential attacks (ZDI Advisory).