PT-2025-7322 · Carrier · Carrier Hvac

Ahil Shah + 1 · Publicado 2025-02-20 · Atualizado 2026-02-05 · CVE-2024-10930

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Carrier - Block Load versions 4.00 through 4.16

Description An uncontrolled search path element issue exists, potentially allowing an attacker to perform DLL hijacking and execute arbitrary code with elevated privileges. This issue is reportedly being actively exploited. DLL hijacking occurs when a program loads a malicious DLL instead of a legitimate one, leading to code execution.

Recommendations Versions 4.00 through 4.16: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2024-10930

Produtos afetados

Carrier Hvac

Referências · 19

• https://twitter.com/transilienceai/status/1899610423051030897 · Publicação no Twitter
• https://twitter.com/cybercronai/status/1897508777223495817 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1898525275568161026 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-10930 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-10930 · Aviso do Fabricante
• https://twitter.com/syedaquib77/status/1892840263451808123 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1897809670040867229 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1897133272838095032 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1900158998650728743 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1897261620713120100 · Publicação no Twitter
• https://twitter.com/transilienceai/status/1899807436107616322 · Publicação no Twitter
• https://twitter.com/windowsforum/status/1892702152708989417 · Publicação no Twitter
• https://corporate.carrier.com/product-security/advisories-resources · Aviso do Fabricante
• https://cisa.gov/news-events/ics-advisories/icsa-25-063-01 · Nota
• https://t.me/cvedetector/19526 · Publicação no Telegram