Lucene search

K
cve[email protected]CVE-2024-25724
HistoryMay 21, 2024 - 7:15 p.m.

CVE-2024-25724

2024-05-2119:15:09
web.nvd.nist.gov
46
rti connext
xml parsing
buffer overflow
remote code execution
privilege compromise
sensitive information leakage
service integrity compromise
rtps message
compromised call
malicious parameters
local file system

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

7.6 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queuing Service, and Cloud Discovery Service allows attackers to execute code with the affected service’s privileges, compromise the service’s integrity, leak sensitive information, or crash the service. These attacks could be done via a remote malicious RTPS message; a compromised call with malicious parameters to the RTI_RoutingService_new, rti::recording::Service, RTI_QueuingService_new, or RTI_CDS_Service_new public APIs; or a compromised local file system containing a malicious XML file.

7.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

7.6 High

AI Score

Confidence

High

0 Low

EPSS

Percentile

0.0%

Related for CVE-2024-25724