Malicious Installer Backdoor in Justice AV Solutions Viewer (CVE-2024-4978) Enables Unauthorized C2 Access
What It Is — The Justice AV Solutions (JAVS) Viewer installer ships a tampered binary named fffmpeg.exe that contains malicious code. When executed, it establishes a back‑door connection to an attacker‑controlled command‑and‑control server.
Exploitability — No public exploit code is required; the malicious binary is delivered as part of the legitimate installer package. The presence of the backdoor is confirmed by CISA and NVD analysis. A CVSS score has not been published, but the impact is high because it grants remote command execution.
Affected Products — Justice AV Solutions Viewer installer (all versions distributed with the compromised fffmpeg.exe).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous third‑party software integrity checks and supply‑chain monitoring.
- Provides evidence that a missing control around installer verification can break audit trails and erode buyer confidence.
- Highlights the importance of maintaining verifiable code‑signing and hash‑based validation as part of a defensible security posture.
Recommended Actions
- Immediately verify the SHA‑256 hash of the installed
fffmpeg.exeagainst the vendor’s trusted hash; replace any mismatched binaries. - Enforce code‑signing validation and block unsigned executables on endpoints.
- Update your vendor‑risk program to include automated hash‑verification of all third‑party installers.
- Deploy network monitoring for outbound connections to unknown C2 domains.
- Engage Justice AV Solutions for a clean installer and request a signed artifact.
Source: CISA KEV – CVE‑2024‑4978