PT-2024-9226 · 2N · 2N Access Commander

Published 2024-09-23 · Updated 2024-11-07 · CVE-2024-47254

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: 2N Access Commander versions 3.1.1.2 and prior

Description: The issue is related to an Insufficient Verification of Data Authenticity, which could allow an attacker to escalate their privileges and gain root access to the system. This vulnerability may be exploited by a remote attacker to gain unauthorized system access.

Recommendations: For 2N Access Commander versions 3.1.1.2 and prior, patch the system immediately to prevent exploitation. Additionally, monitor the system for signs of compromise to minimize potential damage. As a temporary workaround, consider restricting access to sensitive areas of the system until a patch is applied.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-807

CWE-345

Related Identifiers

BDU:2024-10914

CVE-2024-47254

Affected Products

2N Access Commander

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-47254 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47254 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10914 · Security Note
• https://2n.com/en-GB/download/Access-Commander-Security-Advisory-2024-11 · Note
• https://twitter.com/oktsec/status/1853763610524221588 · Twitter Post
• https://twitter.com/CVEnew/status/1853732164174823472 · Twitter Post
• https://t.me/cvenotify/100917 · Telegram Post
• https://vuldb.com/?id.283102 · Note
• https://2n.com/en-GB/products/management-platforms/2n-access-commander · Note
• https://t.me/cvedetector/9853 · Telegram Post
• https://claroty.com/team82/disclosure-dashboard/cve-2024-47254 · Note