PT-2025-1985 · Algo Edge · Algo Edge

Published 2025-01-17 · Updated 2025-01-18 · CVE-2024-13026

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Clear

Name of the Vulnerable Software and Affected Versions Algo Edge versions up to 2.1.1

Description A vulnerability exists in the authentication mechanism of Algo Edge, which could allow an attacker with adjacent access to the laboratory network and the Algo Edge system to craft valid authentication tokens and access the component. This issue impacts a previously used (legacy) component of navify Algorithm Suite, and other components of the suite are not affected.

Recommendations For Algo Edge versions up to 2.1.1, consider disabling the authentication mechanism temporarily until a patch is available. Restrict access to the Algo Edge system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2024-13026

Affected Products

Algo Edge

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-13026 · Security Note
• https://diagnostics.roche.com/content/dam/diagnostics/Blueprint/en/pdf/Algo%20Edge%20-%20Authentication%20Vulnerability%20-%20Product%20Security%20Advisory.pdf · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1880432502461911331 · Twitter Post
• https://twitter.com/CVETracker/status/1880706915107217650 · Twitter Post
• https://t.me/cvedetector/15737 · Telegram Post
• https://twitter.com/CVEnew/status/1880384716089471478 · Twitter Post