PT-2025-11126 · Avid · Avid Nexis E-Series+2

Drivebyte + 1 · Published 2025-03-12 · Updated 2025-03-14 · CVE-2024-26290

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Avid NEXIS E-series versions prior to 2024.6.0 Avid NEXIS F-series versions prior to 2024.6.0 Avid NEXIS PRO+ versions prior to 2024.6.0 System Director Appliance (SDA+) versions prior to 2024.6.0

Description: The issue is related to an Improper Input Validation vulnerability in Avid products on Linux, allowing code execution on the underlying operating system with root permissions.

Recommendations: Update Avid NEXIS E-series to version 2024.6.0 or later Update Avid NEXIS F-series to version 2024.6.0 or later Update Avid NEXIS PRO+ to version 2024.6.0 or later Update System Director Appliance (SDA+) to version 2024.6.0 or later

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2024-26290

Affected Products

Avid Nexis E-Series

Avid Nexis Pro+

System Director Appliance

References · 12

• https://kb.avid.com/pkb/articles/troubleshooting/en239659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26290 · Security Note
• https://twitter.com/WolfgangSesin/status/1900004785014649164 · Twitter Post
• https://drive-byte.de/en/blog/avid-nexis-agent-multiple-vulnerabilities · Note
• https://twitter.com/cybercronai/status/1900453175204753743 · Twitter Post
• https://t.me/cvenotify/114524 · Telegram Post
• https://twitter.com/vuldb/status/1900231906446500003 · Twitter Post
• https://t.me/cvedetector/20166 · Telegram Post
• https://t.me/cvetracker/19020 · Telegram Post
• https://twitter.com/CveFindCom/status/1899913702423359589 · Twitter Post
• https://twitter.com/CVEnew/status/1899931877357871322 · Twitter Post
• https://raeph123.github.io/BlogPosts/Avid_Nexis/Advisory_Avid_Nexus_Agent_Multiple_Vulnerabilities_en.html · Note