PT-2024-29689 · Atos · Atos Eviden Icare

Published 2024-09-30 · Updated 2024-10-29 · CVE-2024-42017

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions Atos Eviden iCare versions 2.7.1 through 2.7.11

Description The application exposes a web interface locally. In the worst-case scenario, if the application is remotely accessible, it allows an attacker to execute arbitrary commands with system privilege on the endpoint hosting the application, without any authentication.

Recommendations For Atos Eviden iCare versions 2.7.1 through 2.7.11, as a temporary workaround, consider restricting access to the locally exposed web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2024-42017

Affected Products

Atos Eviden Icare

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-42017 · Security Note
• https://twitter.com/CVEnew/status/1840811697654693972 · Twitter Post
• https://support.bull.com/ols/product/security/psirt/security-bulletins/multiple-critical-vulnerabilities-in-icare-psirt-625-tlp-clear-version-0-7-cve-2024-42017/view · Note
• https://twitter.com/VulmonFeeds/status/1840862271754408325 · Twitter Post
• https://twitter.com/cracbot/status/1842082303729926297 · Twitter Post
• https://t.me/cvedetector/6677 · Telegram Post
• https://twitter.com/CveFindCom/status/1840814459608088983 · Twitter Post
• https://eviden.com · Note